diff --git "a/datasets/switch3_dataset_900.jsonl" "b/datasets/switch3_dataset_900.jsonl"
new file mode 100644--- /dev/null
+++ "b/datasets/switch3_dataset_900.jsonl"
@@ -0,0 +1,900 @@
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/22", "vlan": 10}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/22", "storm_control": true, "storm_type": "multicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/22", "no storm-control broadcast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/19", "vlan": 10}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/19", "storm_control": true, "storm_type": "multicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/19", "no storm-control multicast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/14", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/14", "broadcast_pps": 100000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/14", "storm-control broadcast level 1.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/4", "vlan": 40}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/4", "storm_control": true, "storm_type": "multicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/4", "storm-control broadcast level 5.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/23", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/23", "storm_control": true, "storm_type": "broadcast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/23", "no storm-control broadcast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/3", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/3", "lldp receive"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/12", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/12", "lldp transmit"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/19", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/19", "broadcast_pps": 50000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/19", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/15", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/15", "storm_control": true, "storm_type": "broadcast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/15", "no storm-control multicast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/14", "vlan": 10}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/14", "broadcast_pps": 10000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/14", "shutdown"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/3", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/3", "no cdp enable"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/15", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/15", "storm_control": true, "storm_type": "multicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/15", "no storm-control broadcast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/11", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/11", "storm_control": true, "storm_type": "multicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/11", "storm-control broadcast level 5.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/4", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/4", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/4", "no storm-control broadcast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/15", "vlan": 30}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/15", "storm_control": true, "storm_type": "multicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/15", "storm-control broadcast level 5.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/10", "vlan": 50}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/10", "storm_control": true, "storm_type": "multicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/10", "no storm-control broadcast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/24", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/24", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/24", "no storm-control broadcast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/18", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/18", "storm_control": true, "storm_type": "broadcast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/18", "no storm-control multicast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/14", "vlan": 30}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/14", "storm_control": true, "storm_type": "broadcast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/14", "storm-control broadcast level 5.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/7", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/7", "no cdp enable"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/3", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/3", "lldp receive"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/5", "vlan": 20}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "storm_control": true, "storm_type": "multicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/5", "storm-control broadcast level 5.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/6", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/6", "storm_control": true, "storm_type": "multicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/6", "no storm-control broadcast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/8", "vlan": 50}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/8", "broadcast_pps": 50000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/8", "storm-control broadcast level 1.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/2", "vlan": 20}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/2", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/2", "storm-control broadcast level 1.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/19", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/19", "cdp enable"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/6", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/6", "lldp receive"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/3", "vlan": 30}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/3", "storm_control": true, "storm_type": "multicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/3", "no storm-control broadcast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/7", "vlan": 99}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/7", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/7", "storm-control broadcast level 5.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/14", "vlan": 99}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/14", "storm_control": true, "storm_type": "broadcast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/14", "no storm-control broadcast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/10", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/10", "broadcast_pps": 50000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/10", "storm-control broadcast level 1.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/11", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/11", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/11", "storm-control broadcast level 1.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/9", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/9", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/9", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/18", "vlan": 50}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/18", "broadcast_pps": 10000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/18", "storm-control broadcast level 1.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/15", "vlan": 40}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/15", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/15", "no storm-control broadcast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/16", "vlan": 10}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/16", "storm_control": true, "storm_type": "broadcast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/16", "no storm-control broadcast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/18", "vlan": 10}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/18", "broadcast_pps": 50000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/18", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/3", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "storm_control": true, "storm_type": "multicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/3", "storm-control broadcast level 5.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/13", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "storm_control": true, "storm_type": "multicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/13", "no storm-control broadcast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/18", "vlan": 30}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/18", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/18", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/10", "vlan": 50}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/10", "storm_control": true, "storm_type": "broadcast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/10", "storm-control broadcast level 5.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/11", "vlan": 10}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/11", "storm_control": true, "storm_type": "broadcast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/11", "storm-control broadcast level 5.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/7", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/7", "lldp receive"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/1", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/1", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/1", "no storm-control broadcast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/21", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/21", "no cdp enable"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/12", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/12", "broadcast_pps": 100000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/12", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/22", "vlan": 10}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/22", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/22", "storm-control broadcast level 1.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/19", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/19", "lldp transmit"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/13", "vlan": 10}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/13", "storm_control": true, "storm_type": "broadcast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/13", "no storm-control multicast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/13", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/13", "no storm-control multicast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/11", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/11", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/11", "storm-control broadcast level 5.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/2", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/2", "storm_control": true, "storm_type": "broadcast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/2", "storm-control broadcast level 5.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/1", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/1", "storm_control": true, "storm_type": "multicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/1", "storm-control broadcast level 5.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/2", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/2", "storm_control": true, "storm_type": "broadcast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/2", "no storm-control broadcast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/16", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/16", "lldp transmit"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/9", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/9", "cdp enable"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/13", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/13", "no storm-control multicast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/2", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/2", "storm_control": true, "storm_type": "multicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/2", "no storm-control multicast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/20", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/20", "no cdp enable"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/13", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/13", "broadcast_pps": 50000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/13", "storm-control broadcast level 1.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/18", "vlan": 30}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/18", "storm_control": true, "storm_type": "multicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/18", "no storm-control broadcast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/10", "vlan": 30}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/10", "broadcast_pps": 100000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/10", "shutdown"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/8", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/8", "lldp transmit"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/12", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/12", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/12", "storm-control broadcast level 1.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/19", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/19", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/19", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/12", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/12", "broadcast_pps": 10000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/12", "storm-control broadcast level 1.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/8", "vlan": 99}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/8", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/8", "no storm-control broadcast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/6", "lldp receive"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/23", "vlan": 10}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/23", "storm_control": true, "storm_type": "broadcast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/23", "no storm-control broadcast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/12", "vlan": 50}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/12", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/12", "storm-control broadcast level 1.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/3", "vlan": 40}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/3", "broadcast_pps": 10000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/3", "shutdown"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/8", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/8", "lldp receive"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/17", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/17", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/17", "shutdown"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/3", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/3", "lldp receive"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/1", "vlan": 20}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/1", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/1", "storm-control broadcast level 5.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/8", "vlan": 20}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/8", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/8", "storm-control broadcast level 5.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/2", "vlan": 30}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/2", "broadcast_pps": 50000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/2", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/17", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/17", "broadcast_pps": 10000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/17", "shutdown"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/4", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/4", "lldp transmit"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/17", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/17", "cdp enable"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/9", "vlan": 20}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/9", "broadcast_pps": 50000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/9", "storm-control broadcast level 1.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/1", "vlan": 40}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/1", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/1", "storm-control broadcast level 1.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/21", "vlan": 20}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/21", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/21", "storm-control broadcast level 1.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/3", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/3", "lldp receive"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/6", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/6", "storm_control": true, "storm_type": "broadcast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/6", "storm-control broadcast level 5.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/24", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/24", "broadcast_pps": 100000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/24", "shutdown"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/12", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/12", "cdp enable"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/11", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/11", "cdp enable"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/2", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/2", "no cdp enable"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/15", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/15", "broadcast_pps": 100000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/15", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/16", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/16", "broadcast_pps": 100000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/16", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/13", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/13", "broadcast_pps": 100000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/13", "storm-control broadcast level 1.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/13", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/13", "no storm-control multicast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/10", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/10", "lldp transmit"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/11", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/11", "no cdp enable"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/8", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/8", "lldp transmit"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/19", "vlan": 30}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/19", "broadcast_pps": 50000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/19", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/11", "vlan": 40}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/11", "storm_control": true, "storm_type": "broadcast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/11", "no storm-control broadcast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/4", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/4", "lldp transmit"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/14", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/14", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/14", "storm-control broadcast level 5.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/5", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/5", "no cdp enable"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/16", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/16", "lldp transmit"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/7", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/7", "cdp enable"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/2", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/2", "cdp enable"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/11", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/11", "storm_control": true, "storm_type": "broadcast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/11", "storm-control broadcast level 5.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/12", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/12", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/12", "no storm-control multicast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/5", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/5", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/5", "storm-control broadcast level 1.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/20", "vlan": 20}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/20", "storm_control": true, "storm_type": "multicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/20", "no storm-control multicast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/4", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/4", "broadcast_pps": 10000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/4", "shutdown"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/23", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/23", "no cdp enable"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/22", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/22", "storm_control": true, "storm_type": "broadcast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/22", "no storm-control broadcast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/3", "lldp receive"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/24", "vlan": 10}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/24", "broadcast_pps": 10000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/24", "storm-control broadcast level 1.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/8", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/8", "lldp receive"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/18", "vlan": 20}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/18", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/18", "storm-control broadcast level 1.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/1", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/1", "lldp transmit"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/6", "vlan": 10}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/6", "storm-control broadcast level 1.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/23", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/23", "broadcast_pps": 10000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/23", "shutdown"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/22", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/22", "lldp transmit"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/6", "vlan": 20}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "storm_control": true, "storm_type": "multicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/6", "storm-control broadcast level 5.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/12", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/12", "broadcast_pps": 100000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/12", "storm-control broadcast level 1.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/11", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/11", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/11", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/21", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/21", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/21", "no storm-control broadcast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/10", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/10", "broadcast_pps": 50000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/10", "storm-control broadcast level 1.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/13", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/13", "cdp enable"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/20", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/20", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/20", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/2", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/2", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/2", "shutdown"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/12", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/12", "lldp receive"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/17", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/17", "lldp receive"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/6", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/6", "no cdp enable"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/20", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/20", "broadcast_pps": 100000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/20", "storm-control broadcast level 1.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/7", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/7", "lldp receive"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/22", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/22", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/22", "no storm-control broadcast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/17", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/17", "storm_control": true, "storm_type": "multicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/17", "no storm-control broadcast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/5", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/5", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/5", "storm-control broadcast level 1.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/20", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/20", "no cdp enable"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/3", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/3", "lldp transmit"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/9", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/9", "lldp receive"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/2", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/2", "storm_control": true, "storm_type": "multicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/2", "storm-control broadcast level 5.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/6", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/6", "broadcast_pps": 10000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/6", "storm-control broadcast level 1.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/11", "vlan": 10}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/11", "storm_control": true, "storm_type": "broadcast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/11", "no storm-control multicast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/6", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/6", "storm_control": true, "storm_type": "multicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/6", "storm-control broadcast level 5.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/12", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/12", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/12", "no storm-control multicast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/2", "vlan": 20}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/2", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/2", "no storm-control broadcast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/3", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "broadcast_pps": 10000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/3", "shutdown"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/22", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/22", "lldp transmit"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/24", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/24", "storm_control": true, "storm_type": "multicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/24", "no storm-control multicast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/3", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "broadcast_pps": 10000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/3", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/16", "vlan": 10}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/16", "storm_control": true, "storm_type": "broadcast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/16", "no storm-control multicast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/15", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/15", "cdp enable"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/12", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/12", "no cdp enable"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/11", "vlan": 20}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/11", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/11", "storm-control broadcast level 1.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/9", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/9", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/9", "no storm-control multicast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/1", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/1", "broadcast_pps": 10000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/1", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/6", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/6", "storm_control": true, "storm_type": "multicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/6", "no storm-control multicast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/20", "vlan": 40}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/20", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/20", "no storm-control multicast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/24", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/24", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/24", "no storm-control broadcast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/17", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/17", "cdp enable"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/10", "vlan": 20}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/10", "storm_control": true, "storm_type": "multicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/10", "storm-control broadcast level 5.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/24", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/24", "broadcast_pps": 100000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/24", "shutdown"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/10", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/10", "lldp transmit"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/18", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/18", "lldp transmit"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/17", "vlan": 99}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/17", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/17", "no storm-control multicast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/8", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/8", "broadcast_pps": 100000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/8", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/2", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/2", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/2", "storm-control broadcast level 1.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/20", "vlan": 10}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/20", "storm_control": true, "storm_type": "broadcast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/20", "no storm-control multicast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/13", "vlan": 50}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/13", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/13", "storm-control broadcast level 1.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/4", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/4", "no cdp enable"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/5", "vlan": 20}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "broadcast_pps": 100000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/5", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/21", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/21", "broadcast_pps": 50000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/21", "storm-control broadcast level 1.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/17", "vlan": 99}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/17", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/17", "no storm-control multicast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/15", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/15", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/15", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/18", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/18", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/18", "shutdown"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/17", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/17", "cdp enable"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/18", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/18", "lldp receive"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/22", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/22", "lldp transmit"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/13", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "broadcast_pps": 50000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/13", "shutdown"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/1", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/1", "no cdp enable"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/24", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/24", "broadcast_pps": 10000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/24", "storm-control broadcast level 1.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/24", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/24", "storm_control": true, "storm_type": "broadcast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/24", "storm-control broadcast level 5.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/17", "vlan": 40}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/17", "storm_control": true, "storm_type": "multicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/17", "no storm-control broadcast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/13", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/13", "broadcast_pps": 100000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/13", "shutdown"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/8", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/8", "lldp receive"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/14", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/14", "broadcast_pps": 10000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/14", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/15", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/15", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/15", "no storm-control broadcast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/15", "vlan": 30}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/15", "broadcast_pps": 10000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/15", "shutdown"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/3", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/3", "no cdp enable"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/20", "vlan": 99}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/20", "storm_control": true, "storm_type": "multicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/20", "no storm-control multicast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/9", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/9", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/9", "no storm-control broadcast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/4", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/4", "lldp receive"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/3", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/3", "lldp receive"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/1", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/1", "lldp receive"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/18", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/18", "lldp receive"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/23", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/23", "no cdp enable"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/8", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/8", "lldp transmit"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/2", "vlan": 20}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/2", "storm_control": true, "storm_type": "broadcast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/2", "no storm-control broadcast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/3", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/3", "no cdp enable"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/6", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/6", "cdp enable"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/10", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/10", "storm_control": true, "storm_type": "multicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/10", "no storm-control multicast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/18", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/18", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/18", "no storm-control multicast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/9", "vlan": 99}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/9", "broadcast_pps": 100000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/9", "storm-control broadcast level 1.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/6", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/6", "lldp receive"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/12", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/12", "storm_control": true, "storm_type": "broadcast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/12", "no storm-control broadcast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/22", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/22", "broadcast_pps": 100000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/22", "storm-control broadcast level 1.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/13", "vlan": 50}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/13", "broadcast_pps": 100000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/13", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/17", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/17", "broadcast_pps": 10000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/17", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/14", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/14", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/14", "storm-control broadcast level 1.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/14", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/14", "broadcast_pps": 10000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/14", "storm-control broadcast level 1.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/15", "vlan": 50}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/15", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/15", "no storm-control broadcast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/21", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/21", "storm_control": true, "storm_type": "multicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/21", "no storm-control multicast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/21", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/21", "lldp transmit"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/22", "vlan": 10}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/22", "broadcast_pps": 10000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/22", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/22", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/22", "broadcast_pps": 50000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/22", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/22", "vlan": 10}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/22", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/22", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/1", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/1", "storm_control": true, "storm_type": "multicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/1", "storm-control broadcast level 5.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/12", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/12", "lldp receive"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/22", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/22", "broadcast_pps": 100000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/22", "storm-control broadcast level 1.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/15", "vlan": 30}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/15", "broadcast_pps": 10000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/15", "storm-control broadcast level 1.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/8", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/8", "broadcast_pps": 10000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/8", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/14", "vlan": 40}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/14", "storm_control": true, "storm_type": "multicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/14", "storm-control broadcast level 5.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/24", "vlan": 20}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/24", "storm_control": true, "storm_type": "multicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/24", "storm-control broadcast level 5.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/8", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/8", "no cdp enable"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/15", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/15", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/15", "shutdown"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/15", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/15", "lldp transmit"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/18", "vlan": 50}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/18", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/18", "storm-control broadcast level 1.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/16", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/16", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/16", "storm-control broadcast level 5.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/21", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/21", "broadcast_pps": 10000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/21", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/1", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/1", "broadcast_pps": 10000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/1", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/7", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/7", "storm_control": true, "storm_type": "broadcast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/7", "no storm-control multicast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/19", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/19", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/19", "no storm-control broadcast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/16", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/16", "no cdp enable"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/20", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/20", "storm_control": true, "storm_type": "broadcast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/20", "storm-control broadcast level 5.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/11", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/11", "broadcast_pps": 50000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/11", "storm-control broadcast level 1.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/15", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/15", "storm_control": true, "storm_type": "multicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/15", "storm-control broadcast level 5.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/23", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/23", "cdp enable"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/19", "vlan": 20}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/19", "broadcast_pps": 10000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/19", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/8", "vlan": 99}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/8", "storm_control": true, "storm_type": "broadcast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/8", "storm-control broadcast level 5.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/24", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/24", "broadcast_pps": 10000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/24", "storm-control broadcast level 1.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/9", "vlan": 40}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/9", "broadcast_pps": 10000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/9", "storm-control broadcast level 1.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/20", "vlan": 99}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/20", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/20", "storm-control broadcast level 1.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/22", "vlan": 30}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/22", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/22", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/3", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/3", "storm_control": true, "storm_type": "broadcast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/3", "no storm-control broadcast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/15", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/15", "lldp receive"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/1", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/1", "storm_control": true, "storm_type": "multicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/1", "no storm-control broadcast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/3", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/3", "storm-control broadcast level 5.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/3", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/3", "lldp receive"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/10", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/10", "lldp transmit"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/5", "vlan": 40}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "storm_control": true, "storm_type": "broadcast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/5", "no storm-control broadcast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/15", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/15", "storm_control": true, "storm_type": "broadcast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/15", "no storm-control broadcast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/16", "vlan": 50}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/16", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/16", "no storm-control broadcast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/6", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/6", "no cdp enable"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/16", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/16", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/16", "shutdown"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/19", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/19", "lldp receive"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/7", "vlan": 10}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/7", "broadcast_pps": 10000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/7", "storm-control broadcast level 1.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/13", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/13", "lldp receive"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/9", "vlan": 99}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/9", "storm_control": true, "storm_type": "broadcast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/9", "no storm-control multicast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/9", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/9", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/9", "no storm-control broadcast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/16", "vlan": 20}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/16", "broadcast_pps": 10000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/16", "shutdown"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/19", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/19", "no cdp enable"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/7", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/7", "broadcast_pps": 50000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/7", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/16", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/16", "storm_control": true, "storm_type": "broadcast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/16", "no storm-control multicast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/5", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/5", "broadcast_pps": 50000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/5", "shutdown"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/21", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/21", "no cdp enable"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/20", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/20", "storm_control": true, "storm_type": "multicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/20", "storm-control broadcast level 5.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/20", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/20", "lldp transmit"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/3", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/3", "cdp enable"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/9", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/9", "storm_control": true, "storm_type": "broadcast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/9", "no storm-control multicast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/12", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/12", "storm_control": true, "storm_type": "broadcast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/12", "storm-control broadcast level 5.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/18", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/18", "lldp receive"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/9", "vlan": 40}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/9", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/9", "shutdown"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/20", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/20", "lldp transmit"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/24", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/24", "lldp transmit"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/9", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/9", "lldp transmit"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/22", "vlan": 50}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/22", "broadcast_pps": 50000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/22", "storm-control broadcast level 1.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/14", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/14", "broadcast_pps": 100000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/14", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/1", "vlan": 99}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/1", "broadcast_pps": 50000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/1", "storm-control broadcast level 1.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/19", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/19", "broadcast_pps": 100000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/19", "storm-control broadcast level 1.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/14", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/14", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/14", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/1", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/1", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/1", "shutdown"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/3", "cdp enable"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/24", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/24", "storm_control": true, "storm_type": "multicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/24", "no storm-control broadcast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/3", "lldp transmit"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/12", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/12", "storm_control": true, "storm_type": "multicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/12", "storm-control broadcast level 5.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/19", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/19", "storm_control": true, "storm_type": "broadcast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/19", "storm-control broadcast level 5.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/15", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/15", "lldp transmit"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/19", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/19", "broadcast_pps": 10000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/19", "shutdown"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/5", "lldp transmit"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/15", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/15", "cdp enable"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/11", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/11", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/11", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/18", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/18", "broadcast_pps": 10000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/18", "storm-control broadcast level 1.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/15", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/15", "no cdp enable"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/3", "lldp receive"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/11", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/11", "storm_control": true, "storm_type": "broadcast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/11", "no storm-control broadcast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/15", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/15", "storm_control": true, "storm_type": "multicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/15", "no storm-control multicast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/22", "vlan": 30}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/22", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/22", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/1", "vlan": 20}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/1", "broadcast_pps": 10000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/1", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/22", "vlan": 99}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/22", "storm_control": true, "storm_type": "multicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/22", "storm-control broadcast level 5.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/2", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/2", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/2", "no storm-control broadcast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/16", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/16", "lldp receive"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/9", "vlan": 20}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/9", "storm_control": true, "storm_type": "broadcast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/9", "storm-control broadcast level 5.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/23", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/23", "no cdp enable"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/1", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/1", "lldp receive"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/19", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/19", "cdp enable"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/10", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/10", "storm_control": true, "storm_type": "multicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/10", "no storm-control broadcast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/22", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/22", "lldp receive"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/5", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/5", "lldp receive"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/6", "vlan": 30}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/6", "no storm-control broadcast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/7", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/7", "broadcast_pps": 10000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/7", "shutdown"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/11", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/11", "cdp enable"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/1", "vlan": 20}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/1", "broadcast_pps": 10000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/1", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/9", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/9", "broadcast_pps": 10000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/9", "shutdown"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/4", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/4", "cdp enable"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/18", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/18", "storm_control": true, "storm_type": "multicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/18", "storm-control broadcast level 5.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/9", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/9", "lldp receive"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/6", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/6", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/6", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/12", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/12", "broadcast_pps": 50000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/12", "storm-control broadcast level 1.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/11", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/11", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/11", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/17", "vlan": 50}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/17", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/17", "storm-control broadcast level 5.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/1", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/1", "broadcast_pps": 50000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/1", "storm-control broadcast level 1.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/8", "vlan": 20}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/8", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/8", "storm-control broadcast level 1.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/3", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/3", "no cdp enable"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/2", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/2", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/2", "shutdown"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/21", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/21", "lldp transmit"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/15", "vlan": 30}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/15", "storm_control": true, "storm_type": "broadcast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/15", "no storm-control multicast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/12", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/12", "storm_control": true, "storm_type": "broadcast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/12", "storm-control broadcast level 5.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/2", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/2", "storm_control": true, "storm_type": "multicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/2", "no storm-control multicast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/3", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/3", "storm_control": true, "storm_type": "broadcast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/3", "no storm-control multicast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/18", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/18", "broadcast_pps": 50000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/18", "storm-control broadcast level 1.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/21", "vlan": 40}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/21", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/21", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/13", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/13", "broadcast_pps": 10000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/13", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/7", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/7", "broadcast_pps": 100000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/7", "storm-control broadcast level 1.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/1", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/1", "lldp transmit"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/6", "vlan": 50}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/6", "no storm-control multicast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/18", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/18", "storm_control": true, "storm_type": "broadcast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/18", "storm-control broadcast level 5.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/19", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/19", "cdp enable"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/22", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/22", "broadcast_pps": 10000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/22", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/22", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/22", "storm_control": true, "storm_type": "multicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/22", "storm-control broadcast level 5.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/8", "vlan": 20}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/8", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/8", "no storm-control multicast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/17", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/17", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/17", "storm-control broadcast level 5.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/23", "vlan": 99}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/23", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/23", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/5", "vlan": 10}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "broadcast_pps": 100000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/5", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/24", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/24", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/24", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/11", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/11", "storm_control": true, "storm_type": "multicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/11", "storm-control broadcast level 5.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/8", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/8", "no cdp enable"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/10", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/10", "broadcast_pps": 10000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/10", "shutdown"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/24", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/24", "lldp receive"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/11", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/11", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/11", "storm-control broadcast level 1.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/3", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/3", "lldp transmit"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/11", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/11", "broadcast_pps": 10000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/11", "storm-control broadcast level 1.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/8", "vlan": 30}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/8", "storm_control": true, "storm_type": "broadcast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/8", "storm-control broadcast level 5.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/22", "vlan": 40}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/22", "broadcast_pps": 50000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/22", "storm-control broadcast level 1.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/16", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/16", "no cdp enable"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/6", "lldp receive"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/10", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/10", "storm_control": true, "storm_type": "broadcast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/10", "storm-control broadcast level 5.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/20", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/20", "storm_control": true, "storm_type": "broadcast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/20", "storm-control broadcast level 5.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/8", "vlan": 20}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/8", "storm_control": true, "storm_type": "broadcast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/8", "no storm-control multicast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/13", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/13", "lldp receive"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/15", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/15", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/15", "no storm-control multicast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/20", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/20", "no cdp enable"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/15", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/15", "lldp transmit"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/14", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/14", "lldp transmit"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/23", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/23", "storm_control": true, "storm_type": "multicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/23", "storm-control broadcast level 5.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/18", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/18", "no cdp enable"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/19", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/19", "broadcast_pps": 10000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/19", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/19", "vlan": 99}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/19", "storm_control": true, "storm_type": "broadcast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/19", "no storm-control broadcast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/1", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/1", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/1", "no storm-control multicast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/9", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/9", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/9", "storm-control broadcast level 1.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/2", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/2", "cdp enable"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/2", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/2", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/2", "storm-control broadcast level 1.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/12", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/12", "broadcast_pps": 50000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/12", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/1", "vlan": 99}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/1", "storm_control": true, "storm_type": "broadcast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/1", "no storm-control broadcast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/12", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/12", "lldp receive"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/4", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/4", "broadcast_pps": 50000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/4", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/9", "vlan": 50}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/9", "broadcast_pps": 100000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/9", "storm-control broadcast level 1.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/11", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/11", "storm_control": true, "storm_type": "multicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/11", "no storm-control multicast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/24", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/24", "storm_control": true, "storm_type": "broadcast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/24", "storm-control broadcast level 5.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/22", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/22", "lldp transmit"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/17", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/17", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/17", "storm-control broadcast level 1.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/1", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/1", "lldp receive"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/11", "vlan": 50}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/11", "broadcast_pps": 50000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/11", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/20", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/20", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/20", "no storm-control broadcast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/11", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/11", "cdp enable"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/5", "vlan": 99}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "broadcast_pps": 50000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/5", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/17", "vlan": 30}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/17", "broadcast_pps": 10000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/17", "storm-control broadcast level 1.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/13", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/13", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/13", "no storm-control multicast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/8", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/8", "broadcast_pps": 50000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/8", "shutdown"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/13", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/13", "lldp transmit"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/18", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/18", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/18", "no storm-control multicast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/18", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/18", "lldp receive"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/4", "vlan": 30}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/4", "storm_control": true, "storm_type": "broadcast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/4", "no storm-control multicast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/2", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/2", "broadcast_pps": 50000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/2", "shutdown"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/6", "no cdp enable"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/4", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/4", "storm_control": true, "storm_type": "broadcast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/4", "no storm-control broadcast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/6", "vlan": 30}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "broadcast_pps": 50000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/6", "shutdown"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/4", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/4", "cdp enable"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/12", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/12", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/12", "storm-control broadcast level 5.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/17", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/17", "lldp transmit"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/15", "vlan": 10}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/15", "storm_control": true, "storm_type": "broadcast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/15", "no storm-control multicast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/9", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/9", "no cdp enable"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/19", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/19", "storm_control": true, "storm_type": "broadcast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/19", "no storm-control multicast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/18", "vlan": 50}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/18", "storm_control": true, "storm_type": "broadcast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/18", "no storm-control broadcast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/19", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/19", "no cdp enable"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/2", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/2", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/2", "storm-control broadcast level 5.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/11", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/11", "broadcast_pps": 50000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/11", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/1", "vlan": 99}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/1", "storm_control": true, "storm_type": "multicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/1", "storm-control broadcast level 5.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/2", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/2", "broadcast_pps": 10000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/2", "storm-control broadcast level 1.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/14", "vlan": 50}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/14", "storm_control": true, "storm_type": "broadcast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/14", "no storm-control broadcast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/22", "vlan": 20}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/22", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/22", "storm-control broadcast level 1.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/4", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/4", "storm_control": true, "storm_type": "multicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/4", "storm-control broadcast level 5.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/18", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/18", "lldp transmit"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/6", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/6", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/6", "no storm-control broadcast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/20", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/20", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/20", "no storm-control broadcast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/6", "vlan": 40}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "broadcast_pps": 50000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/6", "storm-control broadcast level 1.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/19", "vlan": 99}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/19", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/19", "no storm-control multicast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/17", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/17", "lldp receive"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/6", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/6", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/6", "no storm-control broadcast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/24", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/24", "lldp receive"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/18", "vlan": 20}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/18", "storm_control": true, "storm_type": "broadcast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/18", "storm-control broadcast level 5.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/23", "vlan": 99}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/23", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/23", "shutdown"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/16", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/16", "lldp receive"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/18", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/18", "lldp transmit"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/20", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/20", "storm_control": true, "storm_type": "multicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/20", "no storm-control multicast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/17", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/17", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/17", "shutdown"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/1", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/1", "lldp transmit"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/9", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/9", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/9", "no storm-control multicast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/11", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/11", "storm_control": true, "storm_type": "multicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/11", "no storm-control multicast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/16", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/16", "cdp enable"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/3", "vlan": 10}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/3", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/3", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/3", "vlan": 20}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/3", "storm_control": true, "storm_type": "multicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/3", "no storm-control broadcast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/23", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/23", "lldp transmit"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/16", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/16", "lldp transmit"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/18", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/18", "lldp transmit"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/23"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/23", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/23", "lldp transmit"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/23", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/23", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/23", "storm-control broadcast level 1.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/10", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/10", "cdp enable"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/15", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/15", "lldp transmit"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/20", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/20", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/20", "shutdown"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/5", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/5", "cdp enable"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/8", "vlan": 10}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/8", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/8", "storm-control broadcast level 5.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/16", "vlan": 30}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/16", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/16", "storm-control broadcast level 1.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/3", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "broadcast_pps": 100000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/3", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/19", "vlan": 99}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/19", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/19", "no storm-control multicast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/17", "vlan": 30}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/17", "broadcast_pps": 10000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/17", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/21", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/21", "storm_control": true, "storm_type": "broadcast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/21", "storm-control broadcast level 5.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/17", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/17", "lldp transmit"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/17", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/17", "cdp enable"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/9", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/9", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/9", "storm-control broadcast level 5.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/8", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/8", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/8", "no storm-control broadcast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/15", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/15", "lldp receive"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/17", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/17", "cdp enable"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/24", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/24", "storm_control": true, "storm_type": "broadcast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/24", "storm-control broadcast level 5.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/8", "vlan": 20}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/8", "broadcast_pps": 10000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/8", "storm-control broadcast level 1.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/6", "vlan": 99}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "broadcast_pps": 10000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/6", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/10", "vlan": 10}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/10", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/10", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/11", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/11", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/11", "storm-control broadcast level 5.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/5", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/5", "broadcast_pps": 100000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/5", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/1", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/1", "broadcast_pps": 10000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/1", "storm-control broadcast level 1.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/18", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/18", "storm_control": true, "storm_type": "multicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/18", "storm-control broadcast level 5.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/11", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/11", "lldp transmit"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/4", "vlan": 30}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/4", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/4", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/8", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/8", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/8", "no storm-control broadcast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/1", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/1", "lldp receive"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/13", "lldp transmit"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/11", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/11", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/11", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/24", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/24", "broadcast_pps": 10000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/24", "storm-control broadcast level 1.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/21", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/21", "cdp enable"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/21", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/21", "lldp receive"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/21", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/21", "cdp enable"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/3", "vlan": 10}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/3", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/3", "storm-control broadcast level 5.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/12", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/12", "storm_control": true, "storm_type": "multicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/12", "no storm-control broadcast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/7", "vlan": 10}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/7", "storm_control": true, "storm_type": "broadcast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/7", "storm-control broadcast level 5.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/10", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/10", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/10", "no storm-control multicast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/10", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/10", "no cdp enable"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/15", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/15", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/15", "no storm-control broadcast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/15", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/15", "lldp receive"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/5", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/5", "no cdp enable"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/15", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/15", "broadcast_pps": 10000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/15", "storm-control broadcast level 1.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/2", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/2", "storm_control": true, "storm_type": "broadcast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/2", "storm-control broadcast level 5.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/22", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/22", "broadcast_pps": 50000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/22", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/23", "vlan": 99}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/23", "storm_control": true, "storm_type": "multicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/23", "no storm-control multicast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/13", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/13", "storm-control broadcast level 1.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/18", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/18", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/18", "storm-control broadcast level 5.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/8", "vlan": 10}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/8", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/8", "no storm-control broadcast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/11", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/11", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/11", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/19", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/19", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/19", "storm-control broadcast level 1.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/11", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/11", "lldp receive"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/3", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/3", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/3", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/17", "vlan": 30}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/17", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/17", "no storm-control multicast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/17", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/17", "lldp transmit"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/1", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/1", "storm_control": true, "storm_type": "broadcast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/1", "no storm-control multicast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/12", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/12", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/12", "storm-control broadcast level 1.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/20", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/20", "lldp transmit"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/19", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/19", "broadcast_pps": 10000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/19", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/10", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/10", "broadcast_pps": 10000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/10", "storm-control broadcast level 1.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/10", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/10", "broadcast_pps": 50000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/10", "storm-control broadcast level 1.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/6", "no cdp enable"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/14", "vlan": 30}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/14", "broadcast_pps": 100000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/14", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/11", "vlan": 30}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/11", "broadcast_pps": 50000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/11", "shutdown"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/19", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/19", "cdp enable"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/15", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/15", "cdp enable"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/14", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/14", "lldp transmit"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/15", "vlan": 10}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/15", "storm_control": true, "storm_type": "multicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/15", "no storm-control broadcast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/17", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/17", "storm_control": true, "storm_type": "broadcast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/17", "no storm-control multicast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/20", "vlan": 20}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/20", "broadcast_pps": 50000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/20", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/11", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/11", "storm_control": true, "storm_type": "multicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/11", "no storm-control multicast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/5", "vlan": 40}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "storm_control": true, "storm_type": "multicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/5", "no storm-control multicast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/5", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/5", "cdp enable"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/7", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/7", "broadcast_pps": 50000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/7", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/18", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/18", "broadcast_pps": 100000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/18", "shutdown"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/21", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/21", "cdp enable"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/18", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/18", "lldp receive"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/9", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/9", "storm_control": true, "storm_type": "broadcast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/9", "no storm-control multicast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/20", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/20", "lldp receive"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/5", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/5", "cdp enable"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/3", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "broadcast_pps": 10000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/3", "storm-control broadcast level 1.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/20", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/20", "storm_control": true, "storm_type": "broadcast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/20", "no storm-control broadcast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/24", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/24", "broadcast_pps": 10000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/24", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/22", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/22", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/22", "no storm-control broadcast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/19", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/19", "no cdp enable"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/8", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/8", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/8", "shutdown"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/14", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/14", "lldp transmit"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/3", "vlan": 50}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/3", "storm_control": true, "storm_type": "multicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/3", "storm-control broadcast level 5.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/24", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/24", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/24", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/7", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/7", "broadcast_pps": 10000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/7", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/23", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/23", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/23", "no storm-control broadcast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/18", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/18", "lldp transmit"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/15", "vlan": 40}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/15", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/15", "storm-control broadcast level 1.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/5", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/5", "cdp enable"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/22", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/22", "cdp enable"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/12", "vlan": 30}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/12", "storm_control": true, "storm_type": "multicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/12", "no storm-control broadcast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/6", "lldp transmit"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/20", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/20", "lldp transmit"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/13", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/13", "lldp receive"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/15", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/15", "cdp enable"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/11", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/11", "storm_control": true, "storm_type": "broadcast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/11", "no storm-control multicast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/3", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/3", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/3", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/15", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/15", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/15", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/23", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/23", "broadcast_pps": 10000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/23", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/9", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/9", "broadcast_pps": 10000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/9", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/22", "vlan": 40}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/22", "storm_control": true, "storm_type": "multicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/22", "no storm-control multicast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/1", "vlan": 10}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/1", "storm_control": true, "storm_type": "broadcast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/1", "no storm-control broadcast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/22", "vlan": 10}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/22", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/22", "no storm-control broadcast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/7", "vlan": 10}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/7", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/7", "no storm-control broadcast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/20", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/20", "lldp transmit"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/5", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/5", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/5", "no storm-control broadcast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/7", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/7", "lldp receive"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/15", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/15", "lldp receive"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/16", "vlan": 10}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/16", "broadcast_pps": 10000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/16", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/7", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/7", "broadcast_pps": 10000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/7", "storm-control broadcast level 1.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/21", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/21", "no cdp enable"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/12", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/12", "broadcast_pps": 10000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/12", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/8", "vlan": 40}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/8", "broadcast_pps": 10000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/8", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/9", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/9", "storm_control": true, "storm_type": "multicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/9", "no storm-control multicast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/21", "vlan": 50}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/21", "storm_control": true, "storm_type": "multicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/21", "no storm-control broadcast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/3", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/3", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/12", "vlan": 50}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/12", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/12", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/12", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/12", "broadcast_pps": 100000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/12", "storm-control broadcast level 1.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/18", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/18", "lldp transmit"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/12", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/12", "no cdp enable"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/24", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/24", "lldp receive"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/15", "vlan": 20}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/15", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/15", "no storm-control broadcast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/4", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/4", "broadcast_pps": 100000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/4", "storm-control broadcast level 1.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/3", "vlan": 99}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/3", "broadcast_pps": 10000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/3", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/23", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/23", "broadcast_pps": 50000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/23", "shutdown"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/3", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/3", "cdp enable"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/13", "vlan": 99}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/13", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/13", "no storm-control multicast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/2", "vlan": 50}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/2", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/2", "no storm-control broadcast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/6", "no cdp enable"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/24", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/24", "no cdp enable"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/17", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/17", "storm_control": true, "storm_type": "broadcast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/17", "no storm-control broadcast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/10", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/10", "no cdp enable"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/15", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/15", "no cdp enable"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/13", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/13", "broadcast_pps": 10000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/13", "storm-control broadcast level 1.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/6", "no cdp enable"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/9", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/9", "cdp enable"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/6", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/6", "no cdp enable"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/15", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/15", "no cdp enable"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/3", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/3", "storm_control": true, "storm_type": "broadcast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/3", "storm-control broadcast level 5.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/7", "vlan": 99}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/7", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/7", "storm-control broadcast level 5.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/13", "vlan": 30}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/13", "broadcast_pps": 10000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/13", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/16", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/16", "storm_control": true, "storm_type": "broadcast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/16", "no storm-control broadcast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/10", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/10", "no cdp enable"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/11", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/11", "lldp transmit"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/3", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/3", "cdp enable"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/18", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/18", "no cdp enable"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/20", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/20", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/20", "no storm-control multicast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/21", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/21", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/21", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/16", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/16", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/16", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/18", "vlan": 10}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/18", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/18", "no storm-control broadcast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/16", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/16", "broadcast_pps": 10000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/16", "shutdown"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/9", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/9", "lldp receive"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/10", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/10", "no cdp enable"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/24", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/24", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/24", "no storm-control multicast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/5", "vlan": 10}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "broadcast_pps": 100000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/5", "storm-control broadcast level 1.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/22", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/22", "lldp transmit"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/6", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/6", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/6", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/6", "vlan": 30}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "broadcast_pps": 10000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/6", "storm-control broadcast level 1.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/20", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/20", "storm_control": true, "storm_type": "broadcast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/20", "no storm-control broadcast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/13", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "broadcast_pps": 10000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/13", "shutdown"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/4", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/4", "no cdp enable"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/12", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/12", "storm_control": true, "storm_type": "multicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/12", "no storm-control broadcast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/14", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/14", "lldp transmit"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/1", "vlan": 40}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/1", "broadcast_pps": 100000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/1", "storm-control broadcast level 1.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/21", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/21", "broadcast_pps": 100000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/21", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/6", "vlan": 50}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/6", "no storm-control broadcast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/21", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/21", "lldp receive"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/21", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/21", "broadcast_pps": 10000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/21", "storm-control broadcast level 1.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/3", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/3", "storm-control broadcast level 1.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/7", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/7", "broadcast_pps": 10000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/7", "storm-control broadcast level 1.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/20", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/20", "lldp transmit"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/7", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/7", "no cdp enable"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/2", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/2", "broadcast_pps": 10000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/2", "shutdown"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/5", "lldp transmit"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/15", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/15", "storm_control": true, "storm_type": "multicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/15", "no storm-control broadcast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/11", "vlan": 50}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/11", "storm_control": true, "storm_type": "broadcast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/11", "storm-control broadcast level 5.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/23", "vlan": 40}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/23", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/23", "no storm-control broadcast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/16", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/16", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/16", "storm-control broadcast level 1.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/4", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/4", "broadcast_pps": 100000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/4", "storm-control broadcast level 1.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/19", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/19", "broadcast_pps": 10000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/19", "storm-control broadcast level 1.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/8", "vlan": 30}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/8", "storm_control": true, "storm_type": "broadcast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/8", "storm-control broadcast level 5.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/11", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/11", "broadcast_pps": 50000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/11", "storm-control broadcast level 1.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/10", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/10", "cdp enable"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/8", "vlan": 50}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/8", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/8", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/2", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/2", "broadcast_pps": 10000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/2", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/19", "vlan": 40}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/19", "storm_control": true, "storm_type": "multicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/19", "no storm-control broadcast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/17", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/17", "broadcast_pps": 10000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/17", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/21", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/21", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/21", "no storm-control multicast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/23", "vlan": 99}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/23", "broadcast_pps": 10000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/23", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/14", "vlan": 99}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/14", "storm_control": true, "storm_type": "multicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/14", "storm-control broadcast level 5.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/3", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/3", "cdp enable"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/11", "vlan": 50}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/11", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/11", "storm-control broadcast level 5.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/9", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/9", "storm_control": true, "storm_type": "multicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/9", "no storm-control broadcast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/21", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/21", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/21", "no storm-control broadcast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/8", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/8", "storm_control": true, "storm_type": "multicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/8", "no storm-control broadcast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/13", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/13", "lldp transmit"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/4", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/4", "lldp receive"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/12", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/12", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/12", "storm-control broadcast level 5.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/16", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/16", "broadcast_pps": 100000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/16", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/11", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/11", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/11", "storm-control broadcast level 5.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/13", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/13", "lldp transmit"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/20", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/20", "lldp receive"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/18", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/18", "lldp transmit"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/11", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/11", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/11", "storm-control broadcast level 5.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/9", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/9", "no cdp enable"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/13", "vlan": 50}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/13", "storm_control": true, "storm_type": "broadcast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/13", "no storm-control multicast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/20", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/20", "storm_control": true, "storm_type": "multicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/20", "no storm-control multicast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/2", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/2", "storm_control": true, "storm_type": "multicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/2", "storm-control broadcast level 5.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/15", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/15", "broadcast_pps": 100000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/15", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/19", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/19", "storm_control": true, "storm_type": "broadcast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/19", "storm-control broadcast level 5.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/17", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/17", "storm_control": true, "storm_type": "multicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/17", "no storm-control multicast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/12", "vlan": 40}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/12", "broadcast_pps": 10000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/12", "shutdown"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/11", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/11", "lldp transmit"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/12", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/12", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/12", "storm-control broadcast level 1.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/5", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/5", "storm_control": true, "storm_type": "broadcast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/5", "no storm-control multicast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/12", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/12", "lldp transmit"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/4", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/4", "lldp transmit"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/7", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/7", "broadcast_pps": 100000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/7", "shutdown"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/5", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/5", "lldp receive"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/10", "vlan": 20}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/10", "broadcast_pps": 100000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/10", "storm-control broadcast level 1.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/24", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/24", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/24", "shutdown"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/22", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/22", "lldp transmit"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/18", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/18", "storm_control": true, "storm_type": "broadcast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/18", "storm-control broadcast level 5.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/17", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/17", "cdp enable"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/2", "vlan": 50}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/2", "storm_control": true, "storm_type": "multicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/2", "no storm-control broadcast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/5", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/5", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/5", "storm-control broadcast level 1.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/10", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/10", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/10", "storm-control broadcast level 1.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/5", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/5", "storm_control": true, "storm_type": "multicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/5", "storm-control broadcast level 5.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/3", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/3", "lldp transmit"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/13", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "storm_control": true, "storm_type": "multicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/13", "storm-control broadcast level 5.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/9", "vlan": 50}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/9", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/9", "storm-control broadcast level 1.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/21", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/21", "storm_control": true, "storm_type": "broadcast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/21", "no storm-control broadcast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/22", "vlan": 30}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/22", "storm_control": true, "storm_type": "broadcast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/22", "no storm-control broadcast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/12", "vlan": 30}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/12", "broadcast_pps": 50000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/12", "storm-control broadcast level 1.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/1", "vlan": 40}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/1", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/1", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/18", "vlan": 30}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/18", "broadcast_pps": 50000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/18", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/5", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/5", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/5", "no storm-control broadcast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/3", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/3", "storm_control": true, "storm_type": "broadcast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/3", "storm-control broadcast level 5.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/10", "vlan": 40}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/10", "broadcast_pps": 50000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/10", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/9", "vlan": 20}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/9", "broadcast_pps": 10000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/9", "storm-control broadcast level 1.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/12", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/12", "storm_control": true, "storm_type": "broadcast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/12", "storm-control broadcast level 5.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/20"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/20", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/20", "lldp receive"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/23", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/23", "storm_control": true, "storm_type": "multicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/23", "no storm-control broadcast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/16", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/16", "lldp receive"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/6", "lldp transmit"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/17", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/17", "cdp enable"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/13", "vlan": 40}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/13", "storm_control": true, "storm_type": "multicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/13", "no storm-control broadcast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/16", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/16", "lldp receive"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/18", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/18", "broadcast_pps": 100000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/18", "storm-control broadcast level 1.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/11", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/11", "no cdp enable"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/22", "vlan": 40}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/22", "storm_control": true, "storm_type": "multicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/22", "no storm-control multicast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/4", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/4", "cdp enable"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/1", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/1", "lldp receive"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/8", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/8", "no cdp enable"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/5", "lldp transmit"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/20", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/20", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/20", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/20", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/20", "broadcast_pps": 50000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/20", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/9", "vlan": 50}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/9", "storm_control": true, "storm_type": "broadcast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/9", "no storm-control broadcast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/1", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/1", "cdp enable"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/6", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/6", "no cdp enable"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/8", "vlan": 10}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/8", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/8", "storm-control broadcast level 5.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/10", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/10", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/10", "shutdown"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/4", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/4", "cdp enable"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/9", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/9", "storm_control": true, "storm_type": "multicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/9", "no storm-control multicast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/3", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/3", "storm_control": true, "storm_type": "multicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/3", "storm-control broadcast level 5.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/8", "vlan": 10}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/8", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/8", "storm-control broadcast level 1.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/12", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/12", "broadcast_pps": 10000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/12", "storm-control broadcast level 1.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/10", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/10", "cdp enable"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/19", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/19", "storm_control": true, "storm_type": "broadcast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/19", "no storm-control broadcast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/13", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "storm_control": true, "storm_type": "broadcast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/13", "no storm-control multicast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/17", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/17", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/17", "storm-control broadcast level 1.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/14", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/14", "storm_control": true, "storm_type": "broadcast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/14", "storm-control broadcast level 5.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/22", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/22", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/22", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/16", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/16", "storm_control": true, "storm_type": "multicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/16", "storm-control broadcast level 5.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/6", "no cdp enable"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/5", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/5", "no cdp enable"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/21", "vlan": 10}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/21", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/21", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/5", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/5", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/5", "shutdown"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/1", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/1", "cdp enable"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/23", "vlan": 20}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/23", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/23", "no storm-control multicast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/7"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/7", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/7", "lldp receive"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/18", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/18", "lldp receive"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/5", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/5", "broadcast_pps": 50000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/5", "storm-control broadcast level 1.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/4", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/4", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/4", "storm-control broadcast level 5.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/6", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/6", "lldp transmit"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/8", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/8", "lldp receive"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/24", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/24", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/24", "no storm-control multicast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/8", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/8", "lldp receive"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/4", "vlan": 99}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/4", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/4", "storm-control broadcast level 5.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/15", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/15", "broadcast_pps": 10000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/15", "storm-control broadcast level 1.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/12", "vlan": 99}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/12", "storm_control": true, "storm_type": "multicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/12", "storm-control broadcast level 5.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/14", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/14", "storm_control": true, "storm_type": "broadcast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/14", "storm-control broadcast level 5.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/10", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/10", "lldp receive"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/3", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/3", "no storm-control broadcast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/12", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/12", "cdp enable"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/13", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "storm_control": true, "storm_type": "broadcast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/13", "no storm-control broadcast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/10", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/10", "lldp receive"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/16", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/16", "storm_control": true, "storm_type": "multicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/16", "no storm-control broadcast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/2", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/2", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/2", "storm-control broadcast level 1.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/11", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/11", "cdp enable"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/2", "vlan": 20}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/2", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/2", "storm-control broadcast level 5.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/19", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/19", "lldp transmit"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/24", "vlan": 99}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/24", "broadcast_pps": 10000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/24", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/18", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/18", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/18", "storm-control broadcast level 5.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/12", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/12", "storm_control": true, "storm_type": "multicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/12", "no storm-control multicast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/7", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/7", "broadcast_pps": 50000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/7", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/4", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/4", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/4", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/21", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/21", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/21", "no storm-control multicast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/21", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/21", "broadcast_pps": 50000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/21", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/22", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/22", "broadcast_pps": 100000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/22", "shutdown"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/11", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/11", "cdp enable"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/15", "vlan": 30}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/15", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/15", "no storm-control multicast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/15", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/15", "lldp transmit"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/12", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/12", "storm_control": true, "storm_type": "broadcast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/12", "storm-control broadcast level 5.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/11", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/11", "broadcast_pps": 50000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/11", "storm-control broadcast level 1.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/9", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/9", "storm_control": true, "storm_type": "broadcast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/9", "no storm-control broadcast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/16", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/16", "cdp enable"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/1", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/1", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/1", "storm-control broadcast level 1.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/6", "vlan": 20}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "broadcast_pps": 100000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/6", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/5", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/5", "storm_control": true, "storm_type": "multicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/5", "storm-control broadcast level 5.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/2", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/2", "storm_control": true, "storm_type": "broadcast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/2", "no storm-control multicast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/16", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/16", "cdp enable"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/24", "vlan": 50}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/24", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/24", "storm-control broadcast level 5.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/17", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/17", "lldp transmit"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/16", "vlan": 40}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/16", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/16", "storm-control broadcast level 5.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/23", "vlan": 20}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/23", "storm_control": true, "storm_type": "multicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/23", "no storm-control broadcast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/4", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/4", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/4", "storm-control broadcast level 1.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/17", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/17", "cdp enable"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/5"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/5", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/5", "cdp enable"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/13", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/13", "no storm-control broadcast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/6", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/6", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/6", "no storm-control multicast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/6", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/6", "cdp enable"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/16", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/16", "no cdp enable"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/13", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/13", "no cdp enable"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/14", "vlan": 99}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/14", "broadcast_pps": 10000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/14", "storm-control broadcast level 1.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/16", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/16", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/16", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/8", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/8", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/8", "no storm-control multicast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/13", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/13", "lldp receive"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/3", "no cdp enable"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/1", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/1", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/1", "shutdown"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/16", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/16", "lldp receive"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/5", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/5", "broadcast_pps": 50000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/5", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/6", "vlan": 30}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/6", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/6", "storm-control broadcast level 1.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/14", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/14", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/14", "no storm-control multicast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/8", "vlan": 20}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/8", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/8", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/2", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/2", "broadcast_pps": 100000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/2", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/22", "vlan": 40}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/22", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/22", "no storm-control multicast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/11"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/11", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/11", "lldp transmit"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/5", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/5", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/5", "no storm-control multicast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/1", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/1", "storm_control": true, "storm_type": "multicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/1", "storm-control broadcast level 5.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/19", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/19", "lldp receive"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/17"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/17", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/17", "cdp enable"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/16", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/16", "storm_control": true, "storm_type": "broadcast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/16", "no storm-control broadcast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/17", "vlan": 50}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/17", "broadcast_pps": 100000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/17", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/2", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/2", "storm_control": true, "storm_type": "multicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/2", "no storm-control broadcast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/4", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/4", "lldp receive"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/11", "vlan": 50}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/11", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/11", "storm-control broadcast level 1.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/8", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/8", "storm_control": true, "storm_type": "multicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/8", "no storm-control multicast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/9", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/9", "broadcast_pps": 10000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/9", "storm-control broadcast level 1.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/22", "vlan": 10}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/22", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/22", "storm-control broadcast level 1.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/19", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/19", "storm_control": true, "storm_type": "multicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/19", "no storm-control broadcast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/19", "vlan": 40}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/19", "broadcast_pps": 100000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/19", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/10", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/10", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/10", "no storm-control multicast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/10", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/10", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/10", "storm-control broadcast level 5.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/22", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/22", "cdp enable"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/21", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/21", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/21", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/5", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/5", "broadcast_pps": 10000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/5", "shutdown"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/4"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/4", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/4", "lldp receive"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/4", "vlan": 40}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/4", "storm_control": true, "storm_type": "multicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/4", "no storm-control multicast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/22", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/22", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/22", "shutdown"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/19", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/19", "lldp transmit"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/8", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/8", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/8", "storm-control broadcast level 5.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/2", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/2", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/2", "no storm-control multicast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/1", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/1", "lldp transmit"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/19", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/19", "broadcast_pps": 10000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/19", "storm-control broadcast level 1.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/3", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "broadcast_pps": 10000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/3", "storm-control broadcast level 1.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/10"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/10", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/10", "cdp enable"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/12", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/12", "cdp enable"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/19", "vlan": 10}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/19", "broadcast_pps": 50000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/19", "storm-control broadcast level 1.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/13", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/13", "lldp transmit"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/12", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/12", "lldp transmit"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/8", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/8", "broadcast_pps": 10000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/8", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/3", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/3", "broadcast_pps": 10000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/3", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/17", "vlan": 10}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/17", "storm_control": true, "storm_type": "broadcast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/17", "no storm-control multicast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/6", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/6", "broadcast_pps": 10000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/6", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/2", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/2", "storm_control": true, "storm_type": "multicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/2", "storm-control broadcast level 5.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/9"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/9", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/9", "cdp enable"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/22"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/22", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/22", "cdp enable"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/8"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/8", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/8", "lldp receive"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/14", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/14", "cdp enable"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/24", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/24", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/24", "storm-control broadcast level 1.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/4", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/4", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/4", "shutdown"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/1", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/1", "no cdp enable"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/16", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/16", "no cdp enable"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/4", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/4", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/4", "shutdown"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/2", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/2", "no cdp enable"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/3"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/3", "lldp transmit"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/15", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/15", "cdp enable"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/14", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/14", "lldp receive"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/6", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/6", "no cdp enable"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/14", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/14", "storm_control": true, "storm_type": "broadcast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/14", "no storm-control multicast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/15", "vlan": 10}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/15", "storm_control": true, "storm_type": "multicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/15", "storm-control broadcast level 5.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/14", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/14", "lldp transmit"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/8", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/8", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/8", "shutdown"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/1"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/1", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/1", "lldp receive"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/5", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/5", "broadcast_pps": 10000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/5", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/10", "vlan": 99}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/10", "broadcast_pps": 50000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/10", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/12", "vlan": 10}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/12", "broadcast_pps": 10000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/12", "storm-control broadcast level 1.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/23", "vlan": 20}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/23", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/23", "storm-control broadcast level 1.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/9", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/9", "broadcast_pps": 100000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/9", "storm-control broadcast level 1.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/7", "vlan": 99}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/7", "broadcast_pps": 50000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/7", "storm-control broadcast level 1.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/2", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/2", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/2", "storm-control broadcast level 1.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/12"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/12", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/12", "no cdp enable"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/1", "vlan": 99}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/1", "storm_control": true, "storm_type": "multicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/1", "no storm-control multicast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/15"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/15", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/15", "no cdp enable"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/19", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/19", "lldp transmit"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/19", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/19", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/19", "storm-control broadcast level 5.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/6"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/6", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/6", "lldp receive"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/23", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/23", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/23", "storm-control broadcast level 1.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/18", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/18", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/18", "no storm-control multicast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/13", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/13", "no cdp enable"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/4", "vlan": 20}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/4", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/4", "no storm-control multicast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/11", "vlan": 50}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/11", "storm_control": true, "storm_type": "multicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/11", "storm-control broadcast level 5.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/5", "vlan": 50}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "storm_control": true, "storm_type": "broadcast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/5", "storm-control broadcast level 5.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/13", "vlan": 40}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/13", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/13", "storm-control broadcast level 5.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/13"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/13", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/13", "no cdp enable"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/7", "vlan": 50}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/7", "broadcast_pps": 100000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/7", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/9", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/9", "broadcast_pps": 100000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/9", "storm-control broadcast level 1.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/21", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/21", "cdp enable"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/16", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/16", "storm_control": true, "storm_type": "broadcast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/16", "no storm-control broadcast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/13", "vlan": 20}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/13", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/13", "storm-control broadcast level 1.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/11", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/11", "broadcast_pps": 10000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/11", "storm-control broadcast level 1.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/5", "vlan": 99}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/5", "storm_control": true, "storm_type": "broadcast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/5", "no storm-control multicast"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/3", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/3", "storm_control": true, "storm_type": "multicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/3", "storm-control broadcast level 5.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/11", "vlan": 10}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/11", "broadcast_pps": 10000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/11", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW2", "severity": "high", "interface": "GigabitEthernet0/20", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/20", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.30"}], "cli_fix": ["interface GigabitEthernet0/20", "storm-control broadcast level 5.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/21"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/21", "cdp_enabled": true, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/21", "lldp transmit"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/21", "vlan": 99}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/21", "storm_control": true, "storm_type": "broadcast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/21", "no storm-control broadcast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/20", "vlan": 40}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/20", "broadcast_pps": 50000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/20", "shutdown"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "DIST-SW1", "severity": "medium", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/19", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/19", "no cdp enable"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/5", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/5", "broadcast_pps": 10000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/5", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/3", "vlan": 50}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/3", "broadcast_pps": 50000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/3", "storm-control broadcast level 1.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/23", "vlan": 40}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/23", "broadcast_pps": 100000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/23", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/21", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/21", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/21", "no storm-control broadcast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/19"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/19", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/19", "lldp transmit"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/14"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/14", "cdp_enabled": false, "lldp_enabled": false, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/14", "no cdp enable"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/5", "vlan": 20}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/5", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/5", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/17", "vlan": 40}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/17", "broadcast_pps": 10000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/17", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/11", "vlan": 30}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/11", "storm_control": true, "storm_type": "multicast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/11", "no storm-control broadcast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "DIST-SW1", "severity": "critical", "interface": "GigabitEthernet0/4", "vlan": 20}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/4", "broadcast_pps": 100000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/4", "storm-control broadcast level 1.00"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/2", "vlan": 10}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/2", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/2", "shutdown"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/7", "vlan": 50}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/7", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/7", "storm-control broadcast level 1.00"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "DIST-SW1", "severity": "high", "interface": "GigabitEthernet0/15", "vlan": 30}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/15", "storm_control": true, "storm_type": "broadcast", "threshold": "1.00"}], "cli_fix": ["interface GigabitEthernet0/15", "no storm-control multicast"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/24"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/24", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/24", "lldp receive"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/16", "vlan": 50}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/16", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/16", "shutdown"]}
+{"incident_type": "storm_control_trigger", "instruction": "Analyze storm control incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Storm control threshold exceeded", "device": "ACCESS-SW1", "severity": "high", "interface": "GigabitEthernet0/24", "vlan": 20}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/24", "storm_control": true, "storm_type": "unknown-unicast", "threshold": "0.50"}], "cli_fix": ["interface GigabitEthernet0/24", "no storm-control multicast"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW1", "severity": "critical", "interface": "GigabitEthernet0/10", "vlan": 30}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/10", "broadcast_pps": 50000, "storm_control": false}], "cli_fix": ["interface GigabitEthernet0/10", "shutdown"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/16"}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/16", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/16", "lldp receive"]}
+{"incident_type": "broadcast_storm_detected", "instruction": "Analyze broadcast storm incidents and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Broadcast storm detected", "device": "ACCESS-SW2", "severity": "critical", "interface": "GigabitEthernet0/22", "vlan": 99}, "devices": [{"name": "DIST-SW1", "interface": "GigabitEthernet0/22", "broadcast_pps": 50000, "storm_control": true}], "cli_fix": ["interface GigabitEthernet0/22", "storm-control broadcast level 1.00"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW2", "severity": "medium", "interface": "GigabitEthernet0/2"}, "devices": [{"name": "ACCESS-SW1", "interface": "GigabitEthernet0/2", "cdp_enabled": false, "lldp_enabled": true, "neighbor_type": "Non-Cisco"}], "cli_fix": ["interface GigabitEthernet0/2", "cdp enable"]}
+{"incident_type": "lldp_cdp_inconsistency", "instruction": "Analyze LLDP/CDP inconsistencies and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "LLDP/CDP inconsistency detected", "device": "ACCESS-SW1", "severity": "medium", "interface": "GigabitEthernet0/18"}, "devices": [{"name": "ACCESS-SW2", "interface": "GigabitEthernet0/18", "cdp_enabled": true, "lldp_enabled": true, "neighbor_type": "Cisco"}], "cli_fix": ["interface GigabitEthernet0/18", "no cdp enable"]}