diff --git "a/datasets/sys3_dataset_900_v1.jsonl" "b/datasets/sys3_dataset_900_v1.jsonl"
new file mode 100644--- /dev/null
+++ "b/datasets/sys3_dataset_900_v1.jsonl"
@@ -0,0 +1,900 @@
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T16:43:06.287179Z", "interface": "TenGigabitEthernet1/2", "class": "DATA", "drop_rate_pct": 27, "current_rate_kbps": 10000, "suggested_rate_kbps": 20000, "reason": "burst too small", "description": "Policing drops on TenGigabitEthernet1/2 class=DATA. Current rate 10000 kbps; drops due to burst too small."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/2", "class": "DATA", "current_rate_kbps": 10000, "suggested_rate_kbps": 20000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 20000 16000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:35:06.283193Z", "interface": "TenGigabitEthernet1/1", "application": "voice", "expected_dscp": "cs0", "observed_dscp": "af21", "vlan": 20, "description": "QoS misclassification on TenGigabitEthernet1/1: app=voice, expected DSCP=cs0, observed DSCP=af21 (VLAN 20)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "vlan": 20, "expected_dscp": "cs0", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_BRANCH_TenGi11", " match vlan 20", "policy-map PM_BRANCH_TenGi11", " class CM_BRANCH_TenGi11", "  set dscp cs0", "interface TenGigabitEthernet1/1", " service-policy input PM_BRANCH_TenGi11", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T17:48:06.281912Z", "interface": "GigabitEthernet0/0", "application": "voice", "expected_dscp": "ef", "observed_dscp": "cs3", "vlan": 50, "description": "QoS misclassification on GigabitEthernet0/0: app=voice, expected DSCP=ef, observed DSCP=cs3 (VLAN 50)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "vlan": 50, "expected_dscp": "ef", "observed_dscp": "cs3"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi00", " match vlan 50", "policy-map PM_BRANCH_Gi00", " class CM_BRANCH_Gi00", "  set dscp ef", "interface GigabitEthernet0/0", " service-policy input PM_BRANCH_Gi00", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T14:39:06.287110Z", "interface": "GigabitEthernet0/1", "class": "DATA", "drop_rate_pct": 25, "current_rate_kbps": 2000, "suggested_rate_kbps": 4000, "reason": "token bucket depleted", "description": "Policing drops on GigabitEthernet0/1 class=DATA. Current rate 2000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "class": "DATA", "current_rate_kbps": 2000, "suggested_rate_kbps": 4000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 4000 64000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T18:39:06.280900Z", "routing_process": "eigrp", "pid": 2397, "stuck_minutes": 33, "symptom": "SPF calculation stuck", "description": "Routing process 'eigrp' appears hung (pid=2397), stuck for ~33 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios", "routing_process": "eigrp", "pid": 2397, "stuck_minutes": 33}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T11:39:06.280374Z", "routing_process": "eigrp", "pid": 1525, "stuck_minutes": 35, "symptom": "RIB update stalled", "description": "Routing process 'eigrp' appears hung (pid=1525), stuck for ~35 minutes. Symptom: RIB update stalled."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "routing_process": "eigrp", "pid": 1525, "stuck_minutes": 35}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T17:08:06.288093Z", "interface": "GigabitEthernet0/0", "class": "VOICE", "drop_rate_pct": 34, "current_rate_kbps": 5000, "suggested_rate_kbps": 15000, "reason": "burst too small", "description": "Policing drops on GigabitEthernet0/0 class=VOICE. Current rate 5000 kbps; drops due to burst too small."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "class": "VOICE", "current_rate_kbps": 5000, "suggested_rate_kbps": 15000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 15000 64000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/0", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T18:08:06.285762Z", "interface": "GigabitEthernet0/1", "class": "VIDEO", "drop_rate_pct": 18, "current_rate_kbps": 5000, "suggested_rate_kbps": 10000, "reason": "policer exceed drops", "description": "Policing drops on GigabitEthernet0/1 class=VIDEO. Current rate 5000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "class": "VIDEO", "current_rate_kbps": 5000, "suggested_rate_kbps": 10000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 10000 16000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T13:12:06.285201Z", "interface": "GigabitEthernet0/1", "application": "video", "expected_dscp": "cs3", "observed_dscp": "af31", "vlan": 20, "description": "QoS misclassification on GigabitEthernet0/1: app=video, expected DSCP=cs3, observed DSCP=af31 (VLAN 20)."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "vlan": 20, "expected_dscp": "cs3", "observed_dscp": "af31"}], "cli_fix": ["class-map match-any CM_DCR2_Gi01", " match vlan 20", "policy-map PM_DCR2_Gi01", " class CM_DCR2_Gi01", "  set dscp cs3", "interface GigabitEthernet0/1", " service-policy input PM_DCR2_Gi01", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:55:06.287559Z", "interface": "GigabitEthernet0/0", "class": "DATA", "drop_rate_pct": 36, "current_rate_kbps": 20000, "suggested_rate_kbps": 60000, "reason": "burst too small", "description": "Policing drops on GigabitEthernet0/0 class=DATA. Current rate 20000 kbps; drops due to burst too small."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "class": "DATA", "current_rate_kbps": 20000, "suggested_rate_kbps": 60000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 60000 32000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/0", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T19:13:06.287244Z", "interface": "TenGigabitEthernet1/2", "class": "VOICE", "drop_rate_pct": 27, "current_rate_kbps": 5000, "suggested_rate_kbps": 15000, "reason": "token bucket depleted", "description": "Policing drops on TenGigabitEthernet1/2 class=VOICE. Current rate 5000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/2", "class": "VOICE", "current_rate_kbps": 5000, "suggested_rate_kbps": 15000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 15000 64000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T21:12:06.287527Z", "interface": "GigabitEthernet1/0", "class": "VIDEO", "drop_rate_pct": 13, "current_rate_kbps": 10000, "suggested_rate_kbps": 20000, "reason": "token bucket depleted", "description": "Policing drops on GigabitEthernet1/0 class=VIDEO. Current rate 10000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "class": "VIDEO", "current_rate_kbps": 10000, "suggested_rate_kbps": 20000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 20000 16000 conform-action transmit exceed-action drop", "interface GigabitEthernet1/0", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T13:33:06.283393Z", "interface": "GigabitEthernet1/0", "application": "video", "expected_dscp": "af21", "observed_dscp": "af41", "vlan": 30, "description": "QoS misclassification on GigabitEthernet1/0: app=video, expected DSCP=af21, observed DSCP=af41 (VLAN 30)."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "vlan": 30, "expected_dscp": "af21", "observed_dscp": "af41"}], "cli_fix": ["class-map match-any CM_DCR2_Gi10", " match vlan 30", "policy-map PM_DCR2_Gi10", " class CM_DCR2_Gi10", "  set dscp af21", "interface GigabitEthernet1/0", " service-policy input PM_DCR2_Gi10", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T12:46:06.287470Z", "interface": "GigabitEthernet0/0", "class": "VOICE", "drop_rate_pct": 14, "current_rate_kbps": 10000, "suggested_rate_kbps": 20000, "reason": "token bucket depleted", "description": "Policing drops on GigabitEthernet0/0 class=VOICE. Current rate 10000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "class": "VOICE", "current_rate_kbps": 10000, "suggested_rate_kbps": 20000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 20000 8000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/0", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T19:11:06.285533Z", "interface": "GigabitEthernet0/1", "class": "DATA", "drop_rate_pct": 18, "current_rate_kbps": 10000, "suggested_rate_kbps": 30000, "reason": "burst too small", "description": "Policing drops on GigabitEthernet0/1 class=DATA. Current rate 10000 kbps; drops due to burst too small."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "class": "DATA", "current_rate_kbps": 10000, "suggested_rate_kbps": 30000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 30000 32000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T20:06:06.284293Z", "interface": "GigabitEthernet0/1", "application": "voice", "expected_dscp": "af41", "observed_dscp": "cs0", "vlan": 50, "description": "QoS misclassification on GigabitEthernet0/1: app=voice, expected DSCP=af41, observed DSCP=cs0 (VLAN 50)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "vlan": 50, "expected_dscp": "af41", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_EDGERT_Gi01", " match vlan 50", "policy-map PM_EDGERT_Gi01", " class CM_EDGERT_Gi01", "  set dscp af41", "interface GigabitEthernet0/1", " service-policy input PM_EDGERT_Gi01", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T16:44:06.282461Z", "interface": "GigabitEthernet0/0", "application": "video", "expected_dscp": "af31", "observed_dscp": "af41", "vlan": 30, "description": "QoS misclassification on GigabitEthernet0/0: app=video, expected DSCP=af31, observed DSCP=af41 (VLAN 30)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "vlan": 30, "expected_dscp": "af31", "observed_dscp": "af41"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi00", " match vlan 30", "policy-map PM_BRANCH_Gi00", " class CM_BRANCH_Gi00", "  set dscp af31", "interface GigabitEthernet0/0", " service-policy input PM_BRANCH_Gi00", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T19:30:06.286584Z", "interface": "TenGigabitEthernet1/2", "class": "VOICE", "drop_rate_pct": 20, "current_rate_kbps": 5000, "suggested_rate_kbps": 15000, "reason": "policer exceed drops", "description": "Policing drops on TenGigabitEthernet1/2 class=VOICE. Current rate 5000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "class": "VOICE", "current_rate_kbps": 5000, "suggested_rate_kbps": 15000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 15000 64000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T21:09:06.287816Z", "interface": "GigabitEthernet1/0", "class": "DATA", "drop_rate_pct": 35, "current_rate_kbps": 5000, "suggested_rate_kbps": 10000, "reason": "token bucket depleted", "description": "Policing drops on GigabitEthernet1/0 class=DATA. Current rate 5000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "class": "DATA", "current_rate_kbps": 5000, "suggested_rate_kbps": 10000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 10000 32000 conform-action transmit exceed-action drop", "interface GigabitEthernet1/0", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T20:53:06.280822Z", "routing_process": "eigrp", "pid": 3489, "stuck_minutes": 8, "symptom": "SPF calculation stuck", "description": "Routing process 'eigrp' appears hung (pid=3489), stuck for ~8 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "routing_process": "eigrp", "pid": 3489, "stuck_minutes": 8}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T15:22:06.287850Z", "interface": "GigabitEthernet1/0", "class": "VIDEO", "drop_rate_pct": 31, "current_rate_kbps": 10000, "suggested_rate_kbps": 20000, "reason": "token bucket depleted", "description": "Policing drops on GigabitEthernet1/0 class=VIDEO. Current rate 10000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "class": "VIDEO", "current_rate_kbps": 10000, "suggested_rate_kbps": 20000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 20000 32000 conform-action transmit exceed-action drop", "interface GigabitEthernet1/0", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T17:46:06.280488Z", "routing_process": "bgp", "pid": 416, "stuck_minutes": 36, "symptom": "BGP scanner unresponsive", "description": "Routing process 'bgp' appears hung (pid=416), stuck for ~36 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "routing_process": "bgp", "pid": 416, "stuck_minutes": 36}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T17:38:06.281015Z", "routing_process": "ospf", "pid": 1863, "stuck_minutes": 40, "symptom": "Adjacency state not progressing", "description": "Routing process 'ospf' appears hung (pid=1863), stuck for ~40 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios_xe", "routing_process": "ospf", "pid": 1863, "stuck_minutes": 40}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T16:37:06.286319Z", "interface": "GigabitEthernet0/1", "class": "VIDEO", "drop_rate_pct": 9, "current_rate_kbps": 2000, "suggested_rate_kbps": 4000, "reason": "rate too low", "description": "Policing drops on GigabitEthernet0/1 class=VIDEO. Current rate 2000 kbps; drops due to rate too low."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "class": "VIDEO", "current_rate_kbps": 2000, "suggested_rate_kbps": 4000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 4000 32000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T15:50:06.288056Z", "interface": "TenGigabitEthernet1/1", "class": "VOICE", "drop_rate_pct": 15, "current_rate_kbps": 1000, "suggested_rate_kbps": 3000, "reason": "burst too small", "description": "Policing drops on TenGigabitEthernet1/1 class=VOICE. Current rate 1000 kbps; drops due to burst too small."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "class": "VOICE", "current_rate_kbps": 1000, "suggested_rate_kbps": 3000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 3000 8000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T18:23:06.286634Z", "interface": "GigabitEthernet1/0", "class": "DATA", "drop_rate_pct": 34, "current_rate_kbps": 20000, "suggested_rate_kbps": 40000, "reason": "burst too small", "description": "Policing drops on GigabitEthernet1/0 class=DATA. Current rate 20000 kbps; drops due to burst too small."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "class": "DATA", "current_rate_kbps": 20000, "suggested_rate_kbps": 40000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 40000 16000 conform-action transmit exceed-action drop", "interface GigabitEthernet1/0", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T12:03:06.280072Z", "routing_process": "ospf", "pid": 2662, "stuck_minutes": 20, "symptom": "Routing table not updating", "description": "Routing process 'ospf' appears hung (pid=2662), stuck for ~20 minutes. Symptom: Routing table not updating."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios", "routing_process": "ospf", "pid": 2662, "stuck_minutes": 20}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T11:48:06.284658Z", "interface": "GigabitEthernet1/0", "application": "voice", "expected_dscp": "af21", "observed_dscp": "af31", "vlan": 50, "description": "QoS misclassification on GigabitEthernet1/0: app=voice, expected DSCP=af21, observed DSCP=af31 (VLAN 50)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "vlan": 50, "expected_dscp": "af21", "observed_dscp": "af31"}], "cli_fix": ["class-map match-any CM_EDGERT_Gi10", " match vlan 50", "policy-map PM_EDGERT_Gi10", " class CM_EDGERT_Gi10", "  set dscp af21", "interface GigabitEthernet1/0", " service-policy input PM_EDGERT_Gi10", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T18:05:06.285865Z", "interface": "TenGigabitEthernet1/1", "class": "VIDEO", "drop_rate_pct": 12, "current_rate_kbps": 5000, "suggested_rate_kbps": 15000, "reason": "burst too small", "description": "Policing drops on TenGigabitEthernet1/1 class=VIDEO. Current rate 5000 kbps; drops due to burst too small."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "class": "VIDEO", "current_rate_kbps": 5000, "suggested_rate_kbps": 15000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 15000 64000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T20:23:06.286977Z", "interface": "TenGigabitEthernet1/2", "class": "VIDEO", "drop_rate_pct": 29, "current_rate_kbps": 2000, "suggested_rate_kbps": 6000, "reason": "token bucket depleted", "description": "Policing drops on TenGigabitEthernet1/2 class=VIDEO. Current rate 2000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/2", "class": "VIDEO", "current_rate_kbps": 2000, "suggested_rate_kbps": 6000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 6000 16000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T13:33:06.282854Z", "interface": "TenGigabitEthernet1/1", "application": "backup", "expected_dscp": "af41", "observed_dscp": "cs0", "vlan": 30, "description": "QoS misclassification on TenGigabitEthernet1/1: app=backup, expected DSCP=af41, observed DSCP=cs0 (VLAN 30)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "vlan": 30, "expected_dscp": "af41", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_CORER1_TenGi11", " match vlan 30", "policy-map PM_CORER1_TenGi11", " class CM_CORER1_TenGi11", "  set dscp af41", "interface TenGigabitEthernet1/1", " service-policy input PM_CORER1_TenGi11", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T15:21:06.284792Z", "interface": "TenGigabitEthernet1/1", "application": "video", "expected_dscp": "cs0", "observed_dscp": "af31", "vlan": 10, "description": "QoS misclassification on TenGigabitEthernet1/1: app=video, expected DSCP=cs0, observed DSCP=af31 (VLAN 10)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "vlan": 10, "expected_dscp": "cs0", "observed_dscp": "af31"}], "cli_fix": ["class-map match-any CM_EDGERT_TenGi11", " match vlan 10", "policy-map PM_EDGERT_TenGi11", " class CM_EDGERT_TenGi11", "  set dscp cs0", "interface TenGigabitEthernet1/1", " service-policy input PM_EDGERT_TenGi11", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:48:06.283696Z", "interface": "TenGigabitEthernet1/1", "application": "video", "expected_dscp": "af21", "observed_dscp": "ef", "vlan": 50, "description": "QoS misclassification on TenGigabitEthernet1/1: app=video, expected DSCP=af21, observed DSCP=ef (VLAN 50)."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "vlan": 50, "expected_dscp": "af21", "observed_dscp": "ef"}], "cli_fix": ["class-map match-any CM_DCR2_TenGi11", " match vlan 50", "policy-map PM_DCR2_TenGi11", " class CM_DCR2_TenGi11", "  set dscp af21", "interface TenGigabitEthernet1/1", " service-policy input PM_DCR2_TenGi11", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T12:01:06.279963Z", "routing_process": "eigrp", "pid": 4564, "stuck_minutes": 12, "symptom": "Routing table not updating", "description": "Routing process 'eigrp' appears hung (pid=4564), stuck for ~12 minutes. Symptom: Routing table not updating."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "routing_process": "eigrp", "pid": 4564, "stuck_minutes": 12}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T20:34:06.280655Z", "routing_process": "isis", "pid": 706, "stuck_minutes": 10, "symptom": "Routing table not updating", "description": "Routing process 'isis' appears hung (pid=706), stuck for ~10 minutes. Symptom: Routing table not updating."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "routing_process": "isis", "pid": 706, "stuck_minutes": 10}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T20:08:06.281337Z", "routing_process": "isis", "pid": 4631, "stuck_minutes": 30, "symptom": "RIB update stalled", "description": "Routing process 'isis' appears hung (pid=4631), stuck for ~30 minutes. Symptom: RIB update stalled."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios", "routing_process": "isis", "pid": 4631, "stuck_minutes": 30}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T19:03:06.285771Z", "interface": "TenGigabitEthernet1/2", "class": "DATA", "drop_rate_pct": 32, "current_rate_kbps": 5000, "suggested_rate_kbps": 15000, "reason": "token bucket depleted", "description": "Policing drops on TenGigabitEthernet1/2 class=DATA. Current rate 5000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/2", "class": "DATA", "current_rate_kbps": 5000, "suggested_rate_kbps": 15000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 15000 64000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T11:59:06.284419Z", "interface": "GigabitEthernet1/0", "application": "erp", "expected_dscp": "cs3", "observed_dscp": "cs0", "vlan": 50, "description": "QoS misclassification on GigabitEthernet1/0: app=erp, expected DSCP=cs3, observed DSCP=cs0 (VLAN 50)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "vlan": 50, "expected_dscp": "cs3", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_CORER1_Gi10", " match vlan 50", "policy-map PM_CORER1_Gi10", " class CM_CORER1_Gi10", "  set dscp cs3", "interface GigabitEthernet1/0", " service-policy input PM_CORER1_Gi10", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T14:41:06.284206Z", "interface": "GigabitEthernet0/0", "application": "erp", "expected_dscp": "cs0", "observed_dscp": "af31", "vlan": 20, "description": "QoS misclassification on GigabitEthernet0/0: app=erp, expected DSCP=cs0, observed DSCP=af31 (VLAN 20)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "vlan": 20, "expected_dscp": "cs0", "observed_dscp": "af31"}], "cli_fix": ["class-map match-any CM_CORER2_Gi00", " match vlan 20", "policy-map PM_CORER2_Gi00", " class CM_CORER2_Gi00", "  set dscp cs0", "interface GigabitEthernet0/0", " service-policy input PM_CORER2_Gi00", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:10:06.285245Z", "interface": "GigabitEthernet0/0", "application": "video", "expected_dscp": "af31", "observed_dscp": "ef", "vlan": 40, "description": "QoS misclassification on GigabitEthernet0/0: app=video, expected DSCP=af31, observed DSCP=ef (VLAN 40)."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "vlan": 40, "expected_dscp": "af31", "observed_dscp": "ef"}], "cli_fix": ["class-map match-any CM_DCR1_Gi00", " match vlan 40", "policy-map PM_DCR1_Gi00", " class CM_DCR1_Gi00", "  set dscp af31", "interface GigabitEthernet0/0", " service-policy input PM_DCR1_Gi00", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:51:06.279635Z", "routing_process": "isis", "pid": 4263, "stuck_minutes": 13, "symptom": "Routing table not updating", "description": "Routing process 'isis' appears hung (pid=4263), stuck for ~13 minutes. Symptom: Routing table not updating."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "routing_process": "isis", "pid": 4263, "stuck_minutes": 13}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T15:38:06.288078Z", "interface": "GigabitEthernet0/1", "class": "BULK", "drop_rate_pct": 32, "current_rate_kbps": 5000, "suggested_rate_kbps": 15000, "reason": "rate too low", "description": "Policing drops on GigabitEthernet0/1 class=BULK. Current rate 5000 kbps; drops due to rate too low."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "class": "BULK", "current_rate_kbps": 5000, "suggested_rate_kbps": 15000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 15000 64000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T13:39:06.287872Z", "interface": "GigabitEthernet0/0", "class": "BULK", "drop_rate_pct": 13, "current_rate_kbps": 20000, "suggested_rate_kbps": 60000, "reason": "token bucket depleted", "description": "Policing drops on GigabitEthernet0/0 class=BULK. Current rate 20000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "class": "BULK", "current_rate_kbps": 20000, "suggested_rate_kbps": 60000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 60000 8000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/0", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T18:59:06.280855Z", "routing_process": "bgp", "pid": 4441, "stuck_minutes": 3, "symptom": "SPF calculation stuck", "description": "Routing process 'bgp' appears hung (pid=4441), stuck for ~3 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "routing_process": "bgp", "pid": 4441, "stuck_minutes": 3}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:54:06.280038Z", "routing_process": "ospf", "pid": 2519, "stuck_minutes": 26, "symptom": "SPF calculation stuck", "description": "Routing process 'ospf' appears hung (pid=2519), stuck for ~26 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios", "routing_process": "ospf", "pid": 2519, "stuck_minutes": 26}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T21:10:06.281355Z", "routing_process": "ospf", "pid": 2857, "stuck_minutes": 41, "symptom": "RIB update stalled", "description": "Routing process 'ospf' appears hung (pid=2857), stuck for ~41 minutes. Symptom: RIB update stalled."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "routing_process": "ospf", "pid": 2857, "stuck_minutes": 41}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T13:26:06.288292Z", "interface": "TenGigabitEthernet1/1", "class": "DATA", "drop_rate_pct": 5, "current_rate_kbps": 20000, "suggested_rate_kbps": 60000, "reason": "token bucket depleted", "description": "Policing drops on TenGigabitEthernet1/1 class=DATA. Current rate 20000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "class": "DATA", "current_rate_kbps": 20000, "suggested_rate_kbps": 60000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 60000 16000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T13:01:06.285941Z", "interface": "TenGigabitEthernet1/2", "class": "DATA", "drop_rate_pct": 32, "current_rate_kbps": 1000, "suggested_rate_kbps": 2000, "reason": "burst too small", "description": "Policing drops on TenGigabitEthernet1/2 class=DATA. Current rate 1000 kbps; drops due to burst too small."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "class": "DATA", "current_rate_kbps": 1000, "suggested_rate_kbps": 2000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 2000 16000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T13:16:06.283595Z", "interface": "TenGigabitEthernet1/1", "application": "video", "expected_dscp": "af21", "observed_dscp": "af41", "vlan": 20, "description": "QoS misclassification on TenGigabitEthernet1/1: app=video, expected DSCP=af21, observed DSCP=af41 (VLAN 20)."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "vlan": 20, "expected_dscp": "af21", "observed_dscp": "af41"}], "cli_fix": ["class-map match-any CM_DCR1_TenGi11", " match vlan 20", "policy-map PM_DCR1_TenGi11", " class CM_DCR1_TenGi11", "  set dscp af21", "interface TenGigabitEthernet1/1", " service-policy input PM_DCR1_TenGi11", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T19:55:06.281405Z", "routing_process": "ospf", "pid": 3029, "stuck_minutes": 3, "symptom": "BGP scanner unresponsive", "description": "Routing process 'ospf' appears hung (pid=3029), stuck for ~3 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios_xe", "routing_process": "ospf", "pid": 3029, "stuck_minutes": 3}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T21:20:06.280361Z", "routing_process": "isis", "pid": 1407, "stuck_minutes": 25, "symptom": "BGP scanner unresponsive", "description": "Routing process 'isis' appears hung (pid=1407), stuck for ~25 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "routing_process": "isis", "pid": 1407, "stuck_minutes": 25}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T12:34:06.282598Z", "interface": "TenGigabitEthernet1/2", "application": "erp", "expected_dscp": "cs0", "observed_dscp": "cs3", "vlan": 50, "description": "QoS misclassification on TenGigabitEthernet1/2: app=erp, expected DSCP=cs0, observed DSCP=cs3 (VLAN 50)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "vlan": 50, "expected_dscp": "cs0", "observed_dscp": "cs3"}], "cli_fix": ["class-map match-any CM_BRANCH_TenGi12", " match vlan 50", "policy-map PM_BRANCH_TenGi12", " class CM_BRANCH_TenGi12", "  set dscp cs0", "interface TenGigabitEthernet1/2", " service-policy input PM_BRANCH_TenGi12", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T17:12:06.283545Z", "interface": "TenGigabitEthernet1/2", "application": "voice", "expected_dscp": "cs3", "observed_dscp": "cs0", "vlan": 10, "description": "QoS misclassification on TenGigabitEthernet1/2: app=voice, expected DSCP=cs3, observed DSCP=cs0 (VLAN 10)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/2", "vlan": 10, "expected_dscp": "cs3", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_EDGERT_TenGi12", " match vlan 10", "policy-map PM_EDGERT_TenGi12", " class CM_EDGERT_TenGi12", "  set dscp cs3", "interface TenGigabitEthernet1/2", " service-policy input PM_EDGERT_TenGi12", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T17:18:06.279660Z", "routing_process": "ospf", "pid": 1634, "stuck_minutes": 43, "symptom": "BGP scanner unresponsive", "description": "Routing process 'ospf' appears hung (pid=1634), stuck for ~43 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "routing_process": "ospf", "pid": 1634, "stuck_minutes": 43}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T17:41:06.288130Z", "interface": "TenGigabitEthernet1/1", "class": "BULK", "drop_rate_pct": 20, "current_rate_kbps": 1000, "suggested_rate_kbps": 3000, "reason": "policer exceed drops", "description": "Policing drops on TenGigabitEthernet1/1 class=BULK. Current rate 1000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "class": "BULK", "current_rate_kbps": 1000, "suggested_rate_kbps": 3000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 3000 8000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T18:45:06.288244Z", "interface": "GigabitEthernet1/0", "class": "DATA", "drop_rate_pct": 15, "current_rate_kbps": 10000, "suggested_rate_kbps": 30000, "reason": "policer exceed drops", "description": "Policing drops on GigabitEthernet1/0 class=DATA. Current rate 10000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "class": "DATA", "current_rate_kbps": 10000, "suggested_rate_kbps": 30000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 30000 16000 conform-action transmit exceed-action drop", "interface GigabitEthernet1/0", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T18:24:06.281135Z", "routing_process": "eigrp", "pid": 269, "stuck_minutes": 19, "symptom": "Routing table not updating", "description": "Routing process 'eigrp' appears hung (pid=269), stuck for ~19 minutes. Symptom: Routing table not updating."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "routing_process": "eigrp", "pid": 269, "stuck_minutes": 19}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T18:00:06.281208Z", "routing_process": "eigrp", "pid": 2506, "stuck_minutes": 5, "symptom": "SPF calculation stuck", "description": "Routing process 'eigrp' appears hung (pid=2506), stuck for ~5 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "routing_process": "eigrp", "pid": 2506, "stuck_minutes": 5}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T13:52:06.281611Z", "routing_process": "bgp", "pid": 2786, "stuck_minutes": 40, "symptom": "Routing table not updating", "description": "Routing process 'bgp' appears hung (pid=2786), stuck for ~40 minutes. Symptom: Routing table not updating."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios_xe", "routing_process": "bgp", "pid": 2786, "stuck_minutes": 40}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T20:26:06.280919Z", "routing_process": "bgp", "pid": 4529, "stuck_minutes": 39, "symptom": "Adjacency state not progressing", "description": "Routing process 'bgp' appears hung (pid=4529), stuck for ~39 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "routing_process": "bgp", "pid": 4529, "stuck_minutes": 39}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T13:38:06.285395Z", "interface": "TenGigabitEthernet1/2", "class": "BULK", "drop_rate_pct": 27, "current_rate_kbps": 20000, "suggested_rate_kbps": 40000, "reason": "burst too small", "description": "Policing drops on TenGigabitEthernet1/2 class=BULK. Current rate 20000 kbps; drops due to burst too small."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/2", "class": "BULK", "current_rate_kbps": 20000, "suggested_rate_kbps": 40000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 40000 16000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T12:09:06.288348Z", "interface": "GigabitEthernet0/0", "class": "BULK", "drop_rate_pct": 36, "current_rate_kbps": 1000, "suggested_rate_kbps": 3000, "reason": "policer exceed drops", "description": "Policing drops on GigabitEthernet0/0 class=BULK. Current rate 1000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "class": "BULK", "current_rate_kbps": 1000, "suggested_rate_kbps": 3000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 3000 32000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/0", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T13:26:06.283636Z", "interface": "TenGigabitEthernet1/2", "application": "web", "expected_dscp": "ef", "observed_dscp": "cs0", "vlan": 20, "description": "QoS misclassification on TenGigabitEthernet1/2: app=web, expected DSCP=ef, observed DSCP=cs0 (VLAN 20)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/2", "vlan": 20, "expected_dscp": "ef", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_CORER2_TenGi12", " match vlan 20", "policy-map PM_CORER2_TenGi12", " class CM_CORER2_TenGi12", "  set dscp ef", "interface TenGigabitEthernet1/2", " service-policy input PM_CORER2_TenGi12", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T13:23:06.288137Z", "interface": "TenGigabitEthernet1/1", "class": "DATA", "drop_rate_pct": 10, "current_rate_kbps": 20000, "suggested_rate_kbps": 40000, "reason": "rate too low", "description": "Policing drops on TenGigabitEthernet1/1 class=DATA. Current rate 20000 kbps; drops due to rate too low."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "class": "DATA", "current_rate_kbps": 20000, "suggested_rate_kbps": 40000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 40000 8000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T12:27:06.281159Z", "routing_process": "ospf", "pid": 1932, "stuck_minutes": 36, "symptom": "Adjacency state not progressing", "description": "Routing process 'ospf' appears hung (pid=1932), stuck for ~36 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "routing_process": "ospf", "pid": 1932, "stuck_minutes": 36}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T12:37:06.288275Z", "interface": "TenGigabitEthernet1/1", "class": "DATA", "drop_rate_pct": 15, "current_rate_kbps": 1000, "suggested_rate_kbps": 2000, "reason": "policer exceed drops", "description": "Policing drops on TenGigabitEthernet1/1 class=DATA. Current rate 1000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "class": "DATA", "current_rate_kbps": 1000, "suggested_rate_kbps": 2000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 2000 16000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T21:08:06.281500Z", "routing_process": "ospf", "pid": 4622, "stuck_minutes": 24, "symptom": "RIB update stalled", "description": "Routing process 'ospf' appears hung (pid=4622), stuck for ~24 minutes. Symptom: RIB update stalled."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios", "routing_process": "ospf", "pid": 4622, "stuck_minutes": 24}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T16:52:06.280962Z", "routing_process": "bgp", "pid": 914, "stuck_minutes": 27, "symptom": "BGP scanner unresponsive", "description": "Routing process 'bgp' appears hung (pid=914), stuck for ~27 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "routing_process": "bgp", "pid": 914, "stuck_minutes": 27}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T15:44:06.281661Z", "routing_process": "ospf", "pid": 939, "stuck_minutes": 28, "symptom": "RIB update stalled", "description": "Routing process 'ospf' appears hung (pid=939), stuck for ~28 minutes. Symptom: RIB update stalled."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios_xe", "routing_process": "ospf", "pid": 939, "stuck_minutes": 28}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T20:55:06.287163Z", "interface": "TenGigabitEthernet1/1", "class": "BULK", "drop_rate_pct": 13, "current_rate_kbps": 2000, "suggested_rate_kbps": 4000, "reason": "rate too low", "description": "Policing drops on TenGigabitEthernet1/1 class=BULK. Current rate 2000 kbps; drops due to rate too low."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "class": "BULK", "current_rate_kbps": 2000, "suggested_rate_kbps": 4000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 4000 8000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T11:59:06.287220Z", "interface": "GigabitEthernet0/1", "class": "VOICE", "drop_rate_pct": 36, "current_rate_kbps": 2000, "suggested_rate_kbps": 4000, "reason": "token bucket depleted", "description": "Policing drops on GigabitEthernet0/1 class=VOICE. Current rate 2000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "class": "VOICE", "current_rate_kbps": 2000, "suggested_rate_kbps": 4000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 4000 8000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T11:41:06.285781Z", "interface": "GigabitEthernet1/0", "class": "VIDEO", "drop_rate_pct": 9, "current_rate_kbps": 5000, "suggested_rate_kbps": 10000, "reason": "token bucket depleted", "description": "Policing drops on GigabitEthernet1/0 class=VIDEO. Current rate 5000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "class": "VIDEO", "current_rate_kbps": 5000, "suggested_rate_kbps": 10000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 10000 16000 conform-action transmit exceed-action drop", "interface GigabitEthernet1/0", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T21:30:06.284191Z", "interface": "GigabitEthernet0/1", "application": "voice", "expected_dscp": "cs0", "observed_dscp": "af21", "vlan": 50, "description": "QoS misclassification on GigabitEthernet0/1: app=voice, expected DSCP=cs0, observed DSCP=af21 (VLAN 50)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "vlan": 50, "expected_dscp": "cs0", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi01", " match vlan 50", "policy-map PM_BRANCH_Gi01", " class CM_BRANCH_Gi01", "  set dscp cs0", "interface GigabitEthernet0/1", " service-policy input PM_BRANCH_Gi01", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T18:28:06.286508Z", "interface": "GigabitEthernet0/1", "class": "DATA", "drop_rate_pct": 5, "current_rate_kbps": 2000, "suggested_rate_kbps": 4000, "reason": "policer exceed drops", "description": "Policing drops on GigabitEthernet0/1 class=DATA. Current rate 2000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "class": "DATA", "current_rate_kbps": 2000, "suggested_rate_kbps": 4000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 4000 8000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T17:54:06.284730Z", "interface": "TenGigabitEthernet1/1", "application": "web", "expected_dscp": "af41", "observed_dscp": "cs0", "vlan": 30, "description": "QoS misclassification on TenGigabitEthernet1/1: app=web, expected DSCP=af41, observed DSCP=cs0 (VLAN 30)."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "vlan": 30, "expected_dscp": "af41", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_DCR1_TenGi11", " match vlan 30", "policy-map PM_DCR1_TenGi11", " class CM_DCR1_TenGi11", "  set dscp af41", "interface TenGigabitEthernet1/1", " service-policy input PM_DCR1_TenGi11", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T15:34:06.280058Z", "routing_process": "isis", "pid": 1802, "stuck_minutes": 22, "symptom": "Routing table not updating", "description": "Routing process 'isis' appears hung (pid=1802), stuck for ~22 minutes. Symptom: Routing table not updating."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "routing_process": "isis", "pid": 1802, "stuck_minutes": 22}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T14:55:06.284625Z", "interface": "GigabitEthernet0/0", "application": "erp", "expected_dscp": "af31", "observed_dscp": "af21", "vlan": 50, "description": "QoS misclassification on GigabitEthernet0/0: app=erp, expected DSCP=af31, observed DSCP=af21 (VLAN 50)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "vlan": 50, "expected_dscp": "af31", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_CORER2_Gi00", " match vlan 50", "policy-map PM_CORER2_Gi00", " class CM_CORER2_Gi00", "  set dscp af31", "interface GigabitEthernet0/0", " service-policy input PM_CORER2_Gi00", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T15:52:06.284926Z", "interface": "GigabitEthernet1/0", "application": "voice", "expected_dscp": "af21", "observed_dscp": "ef", "vlan": 20, "description": "QoS misclassification on GigabitEthernet1/0: app=voice, expected DSCP=af21, observed DSCP=ef (VLAN 20)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "vlan": 20, "expected_dscp": "af21", "observed_dscp": "ef"}], "cli_fix": ["class-map match-any CM_EDGERT_Gi10", " match vlan 20", "policy-map PM_EDGERT_Gi10", " class CM_EDGERT_Gi10", "  set dscp af21", "interface GigabitEthernet1/0", " service-policy input PM_EDGERT_Gi10", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T21:04:06.282543Z", "interface": "GigabitEthernet0/1", "application": "web", "expected_dscp": "cs3", "observed_dscp": "af21", "vlan": 30, "description": "QoS misclassification on GigabitEthernet0/1: app=web, expected DSCP=cs3, observed DSCP=af21 (VLAN 30)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "vlan": 30, "expected_dscp": "cs3", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi01", " match vlan 30", "policy-map PM_BRANCH_Gi01", " class CM_BRANCH_Gi01", "  set dscp cs3", "interface GigabitEthernet0/1", " service-policy input PM_BRANCH_Gi01", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T11:54:06.282436Z", "interface": "GigabitEthernet1/0", "application": "video", "expected_dscp": "af21", "observed_dscp": "af41", "vlan": 30, "description": "QoS misclassification on GigabitEthernet1/0: app=video, expected DSCP=af21, observed DSCP=af41 (VLAN 30)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "vlan": 30, "expected_dscp": "af21", "observed_dscp": "af41"}], "cli_fix": ["class-map match-any CM_CORER1_Gi10", " match vlan 30", "policy-map PM_CORER1_Gi10", " class CM_CORER1_Gi10", "  set dscp af21", "interface GigabitEthernet1/0", " service-policy input PM_CORER1_Gi10", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T19:38:06.288063Z", "interface": "GigabitEthernet0/0", "class": "DATA", "drop_rate_pct": 22, "current_rate_kbps": 2000, "suggested_rate_kbps": 6000, "reason": "token bucket depleted", "description": "Policing drops on GigabitEthernet0/0 class=DATA. Current rate 2000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "class": "DATA", "current_rate_kbps": 2000, "suggested_rate_kbps": 6000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 6000 32000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/0", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T20:18:06.281331Z", "routing_process": "ospf", "pid": 2875, "stuck_minutes": 8, "symptom": "Adjacency state not progressing", "description": "Routing process 'ospf' appears hung (pid=2875), stuck for ~8 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "routing_process": "ospf", "pid": 2875, "stuck_minutes": 8}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T11:52:06.280437Z", "routing_process": "ospf", "pid": 3950, "stuck_minutes": 30, "symptom": "Adjacency state not progressing", "description": "Routing process 'ospf' appears hung (pid=3950), stuck for ~30 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "routing_process": "ospf", "pid": 3950, "stuck_minutes": 30}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T19:43:06.282706Z", "interface": "TenGigabitEthernet1/2", "application": "web", "expected_dscp": "ef", "observed_dscp": "af21", "vlan": 10, "description": "QoS misclassification on TenGigabitEthernet1/2: app=web, expected DSCP=ef, observed DSCP=af21 (VLAN 10)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "vlan": 10, "expected_dscp": "ef", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_BRANCH_TenGi12", " match vlan 10", "policy-map PM_BRANCH_TenGi12", " class CM_BRANCH_TenGi12", "  set dscp ef", "interface TenGigabitEthernet1/2", " service-policy input PM_BRANCH_TenGi12", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T20:52:06.281631Z", "routing_process": "bgp", "pid": 2121, "stuck_minutes": 8, "symptom": "Adjacency state not progressing", "description": "Routing process 'bgp' appears hung (pid=2121), stuck for ~8 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "routing_process": "bgp", "pid": 2121, "stuck_minutes": 8}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T12:52:06.281673Z", "routing_process": "ospf", "pid": 4155, "stuck_minutes": 3, "symptom": "Routing table not updating", "description": "Routing process 'ospf' appears hung (pid=4155), stuck for ~3 minutes. Symptom: Routing table not updating."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios", "routing_process": "ospf", "pid": 4155, "stuck_minutes": 3}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T17:57:06.285700Z", "interface": "GigabitEthernet0/1", "class": "DATA", "drop_rate_pct": 38, "current_rate_kbps": 10000, "suggested_rate_kbps": 30000, "reason": "policer exceed drops", "description": "Policing drops on GigabitEthernet0/1 class=DATA. Current rate 10000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "class": "DATA", "current_rate_kbps": 10000, "suggested_rate_kbps": 30000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 30000 16000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T14:42:06.286256Z", "interface": "TenGigabitEthernet1/2", "class": "VIDEO", "drop_rate_pct": 10, "current_rate_kbps": 1000, "suggested_rate_kbps": 2000, "reason": "rate too low", "description": "Policing drops on TenGigabitEthernet1/2 class=VIDEO. Current rate 1000 kbps; drops due to rate too low."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "class": "VIDEO", "current_rate_kbps": 1000, "suggested_rate_kbps": 2000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 2000 32000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T14:59:06.287883Z", "interface": "TenGigabitEthernet1/2", "class": "VIDEO", "drop_rate_pct": 40, "current_rate_kbps": 10000, "suggested_rate_kbps": 20000, "reason": "policer exceed drops", "description": "Policing drops on TenGigabitEthernet1/2 class=VIDEO. Current rate 10000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/2", "class": "VIDEO", "current_rate_kbps": 10000, "suggested_rate_kbps": 20000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 20000 64000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:29:06.282478Z", "interface": "GigabitEthernet0/0", "application": "voice", "expected_dscp": "cs0", "observed_dscp": "af21", "vlan": 40, "description": "QoS misclassification on GigabitEthernet0/0: app=voice, expected DSCP=cs0, observed DSCP=af21 (VLAN 40)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "vlan": 40, "expected_dscp": "cs0", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi00", " match vlan 40", "policy-map PM_BRANCH_Gi00", " class CM_BRANCH_Gi00", "  set dscp cs0", "interface GigabitEthernet0/0", " service-policy input PM_BRANCH_Gi00", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T14:55:06.280381Z", "routing_process": "eigrp", "pid": 1456, "stuck_minutes": 33, "symptom": "SPF calculation stuck", "description": "Routing process 'eigrp' appears hung (pid=1456), stuck for ~33 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios_xe", "routing_process": "eigrp", "pid": 1456, "stuck_minutes": 33}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T21:04:06.283235Z", "interface": "GigabitEthernet0/1", "application": "web", "expected_dscp": "cs3", "observed_dscp": "ef", "vlan": 40, "description": "QoS misclassification on GigabitEthernet0/1: app=web, expected DSCP=cs3, observed DSCP=ef (VLAN 40)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "vlan": 40, "expected_dscp": "cs3", "observed_dscp": "ef"}], "cli_fix": ["class-map match-any CM_EDGERT_Gi01", " match vlan 40", "policy-map PM_EDGERT_Gi01", " class CM_EDGERT_Gi01", "  set dscp cs3", "interface GigabitEthernet0/1", " service-policy input PM_EDGERT_Gi01", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T17:34:06.279818Z", "routing_process": "ospf", "pid": 1784, "stuck_minutes": 19, "symptom": "RIB update stalled", "description": "Routing process 'ospf' appears hung (pid=1784), stuck for ~19 minutes. Symptom: RIB update stalled."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "routing_process": "ospf", "pid": 1784, "stuck_minutes": 19}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T14:40:06.286998Z", "interface": "GigabitEthernet0/0", "class": "DATA", "drop_rate_pct": 9, "current_rate_kbps": 1000, "suggested_rate_kbps": 3000, "reason": "burst too small", "description": "Policing drops on GigabitEthernet0/0 class=DATA. Current rate 1000 kbps; drops due to burst too small."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "class": "DATA", "current_rate_kbps": 1000, "suggested_rate_kbps": 3000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 3000 32000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/0", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T14:09:06.281184Z", "routing_process": "ospf", "pid": 1171, "stuck_minutes": 45, "symptom": "Routing table not updating", "description": "Routing process 'ospf' appears hung (pid=1171), stuck for ~45 minutes. Symptom: Routing table not updating."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "routing_process": "ospf", "pid": 1171, "stuck_minutes": 45}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T12:20:06.282988Z", "interface": "GigabitEthernet0/0", "application": "web", "expected_dscp": "af31", "observed_dscp": "af21", "vlan": 50, "description": "QoS misclassification on GigabitEthernet0/0: app=web, expected DSCP=af31, observed DSCP=af21 (VLAN 50)."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "vlan": 50, "expected_dscp": "af31", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_DCR1_Gi00", " match vlan 50", "policy-map PM_DCR1_Gi00", " class CM_DCR1_Gi00", "  set dscp af31", "interface GigabitEthernet0/0", " service-policy input PM_DCR1_Gi00", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T18:47:06.284130Z", "interface": "TenGigabitEthernet1/1", "application": "web", "expected_dscp": "ef", "observed_dscp": "af41", "vlan": 10, "description": "QoS misclassification on TenGigabitEthernet1/1: app=web, expected DSCP=ef, observed DSCP=af41 (VLAN 10)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "vlan": 10, "expected_dscp": "ef", "observed_dscp": "af41"}], "cli_fix": ["class-map match-any CM_EDGERT_TenGi11", " match vlan 10", "policy-map PM_EDGERT_TenGi11", " class CM_EDGERT_TenGi11", "  set dscp ef", "interface TenGigabitEthernet1/1", " service-policy input PM_EDGERT_TenGi11", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T21:33:06.283612Z", "interface": "TenGigabitEthernet1/2", "application": "video", "expected_dscp": "ef", "observed_dscp": "cs0", "vlan": 10, "description": "QoS misclassification on TenGigabitEthernet1/2: app=video, expected DSCP=ef, observed DSCP=cs0 (VLAN 10)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/2", "vlan": 10, "expected_dscp": "ef", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_BRANCH_TenGi12", " match vlan 10", "policy-map PM_BRANCH_TenGi12", " class CM_BRANCH_TenGi12", "  set dscp ef", "interface TenGigabitEthernet1/2", " service-policy input PM_BRANCH_TenGi12", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T12:04:06.285732Z", "interface": "GigabitEthernet0/1", "class": "BULK", "drop_rate_pct": 23, "current_rate_kbps": 2000, "suggested_rate_kbps": 6000, "reason": "policer exceed drops", "description": "Policing drops on GigabitEthernet0/1 class=BULK. Current rate 2000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "class": "BULK", "current_rate_kbps": 2000, "suggested_rate_kbps": 6000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 6000 16000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T17:11:06.281649Z", "routing_process": "isis", "pid": 4622, "stuck_minutes": 6, "symptom": "Routing table not updating", "description": "Routing process 'isis' appears hung (pid=4622), stuck for ~6 minutes. Symptom: Routing table not updating."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "routing_process": "isis", "pid": 4622, "stuck_minutes": 6}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T20:15:06.287338Z", "interface": "GigabitEthernet1/0", "class": "VOICE", "drop_rate_pct": 34, "current_rate_kbps": 2000, "suggested_rate_kbps": 4000, "reason": "token bucket depleted", "description": "Policing drops on GigabitEthernet1/0 class=VOICE. Current rate 2000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "class": "VOICE", "current_rate_kbps": 2000, "suggested_rate_kbps": 4000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 4000 16000 conform-action transmit exceed-action drop", "interface GigabitEthernet1/0", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T18:06:06.285232Z", "interface": "TenGigabitEthernet1/2", "application": "voice", "expected_dscp": "cs0", "observed_dscp": "af31", "vlan": 50, "description": "QoS misclassification on TenGigabitEthernet1/2: app=voice, expected DSCP=cs0, observed DSCP=af31 (VLAN 50)."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "vlan": 50, "expected_dscp": "cs0", "observed_dscp": "af31"}], "cli_fix": ["class-map match-any CM_DCR1_TenGi12", " match vlan 50", "policy-map PM_DCR1_TenGi12", " class CM_DCR1_TenGi12", "  set dscp cs0", "interface TenGigabitEthernet1/2", " service-policy input PM_DCR1_TenGi12", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T19:38:06.282339Z", "interface": "TenGigabitEthernet1/2", "application": "backup", "expected_dscp": "af21", "observed_dscp": "cs3", "vlan": 50, "description": "QoS misclassification on TenGigabitEthernet1/2: app=backup, expected DSCP=af21, observed DSCP=cs3 (VLAN 50)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "vlan": 50, "expected_dscp": "af21", "observed_dscp": "cs3"}], "cli_fix": ["class-map match-any CM_EDGERT_TenGi12", " match vlan 50", "policy-map PM_EDGERT_TenGi12", " class CM_EDGERT_TenGi12", "  set dscp af21", "interface TenGigabitEthernet1/2", " service-policy input PM_EDGERT_TenGi12", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T18:08:06.279846Z", "routing_process": "eigrp", "pid": 4218, "stuck_minutes": 9, "symptom": "Routing table not updating", "description": "Routing process 'eigrp' appears hung (pid=4218), stuck for ~9 minutes. Symptom: Routing table not updating."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios_xe", "routing_process": "eigrp", "pid": 4218, "stuck_minutes": 9}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T13:08:06.286123Z", "interface": "TenGigabitEthernet1/2", "class": "DATA", "drop_rate_pct": 13, "current_rate_kbps": 20000, "suggested_rate_kbps": 40000, "reason": "policer exceed drops", "description": "Policing drops on TenGigabitEthernet1/2 class=DATA. Current rate 20000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/2", "class": "DATA", "current_rate_kbps": 20000, "suggested_rate_kbps": 40000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 40000 8000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:31:06.283845Z", "interface": "TenGigabitEthernet1/2", "application": "video", "expected_dscp": "af41", "observed_dscp": "ef", "vlan": 30, "description": "QoS misclassification on TenGigabitEthernet1/2: app=video, expected DSCP=af41, observed DSCP=ef (VLAN 30)."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "vlan": 30, "expected_dscp": "af41", "observed_dscp": "ef"}], "cli_fix": ["class-map match-any CM_DCR2_TenGi12", " match vlan 30", "policy-map PM_DCR2_TenGi12", " class CM_DCR2_TenGi12", "  set dscp af41", "interface TenGigabitEthernet1/2", " service-policy input PM_DCR2_TenGi12", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T13:26:06.279811Z", "routing_process": "isis", "pid": 4318, "stuck_minutes": 16, "symptom": "BGP scanner unresponsive", "description": "Routing process 'isis' appears hung (pid=4318), stuck for ~16 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "routing_process": "isis", "pid": 4318, "stuck_minutes": 16}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T17:35:06.281374Z", "routing_process": "bgp", "pid": 3107, "stuck_minutes": 27, "symptom": "BGP scanner unresponsive", "description": "Routing process 'bgp' appears hung (pid=3107), stuck for ~27 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "routing_process": "bgp", "pid": 3107, "stuck_minutes": 27}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T15:11:06.283203Z", "interface": "TenGigabitEthernet1/1", "application": "voice", "expected_dscp": "ef", "observed_dscp": "af31", "vlan": 30, "description": "QoS misclassification on TenGigabitEthernet1/1: app=voice, expected DSCP=ef, observed DSCP=af31 (VLAN 30)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "vlan": 30, "expected_dscp": "ef", "observed_dscp": "af31"}], "cli_fix": ["class-map match-any CM_BRANCH_TenGi11", " match vlan 30", "policy-map PM_BRANCH_TenGi11", " class CM_BRANCH_TenGi11", "  set dscp ef", "interface TenGigabitEthernet1/1", " service-policy input PM_BRANCH_TenGi11", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T21:11:06.287387Z", "interface": "TenGigabitEthernet1/2", "class": "DATA", "drop_rate_pct": 40, "current_rate_kbps": 1000, "suggested_rate_kbps": 3000, "reason": "burst too small", "description": "Policing drops on TenGigabitEthernet1/2 class=DATA. Current rate 1000 kbps; drops due to burst too small."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "class": "DATA", "current_rate_kbps": 1000, "suggested_rate_kbps": 3000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 3000 64000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T20:49:06.280079Z", "routing_process": "bgp", "pid": 374, "stuck_minutes": 9, "symptom": "BGP scanner unresponsive", "description": "Routing process 'bgp' appears hung (pid=374), stuck for ~9 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "routing_process": "bgp", "pid": 374, "stuck_minutes": 9}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T13:18:06.286745Z", "interface": "TenGigabitEthernet1/1", "class": "DATA", "drop_rate_pct": 27, "current_rate_kbps": 1000, "suggested_rate_kbps": 2000, "reason": "burst too small", "description": "Policing drops on TenGigabitEthernet1/1 class=DATA. Current rate 1000 kbps; drops due to burst too small."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "class": "DATA", "current_rate_kbps": 1000, "suggested_rate_kbps": 2000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 2000 64000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T13:28:06.287678Z", "interface": "TenGigabitEthernet1/1", "class": "VIDEO", "drop_rate_pct": 24, "current_rate_kbps": 1000, "suggested_rate_kbps": 3000, "reason": "rate too low", "description": "Policing drops on TenGigabitEthernet1/1 class=VIDEO. Current rate 1000 kbps; drops due to rate too low."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "class": "VIDEO", "current_rate_kbps": 1000, "suggested_rate_kbps": 3000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 3000 16000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T15:10:06.283759Z", "interface": "TenGigabitEthernet1/2", "application": "voice", "expected_dscp": "cs0", "observed_dscp": "af21", "vlan": 50, "description": "QoS misclassification on TenGigabitEthernet1/2: app=voice, expected DSCP=cs0, observed DSCP=af21 (VLAN 50)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "vlan": 50, "expected_dscp": "cs0", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_CORER2_TenGi12", " match vlan 50", "policy-map PM_CORER2_TenGi12", " class CM_CORER2_TenGi12", "  set dscp cs0", "interface TenGigabitEthernet1/2", " service-policy input PM_CORER2_TenGi12", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T20:25:06.281202Z", "routing_process": "bgp", "pid": 2687, "stuck_minutes": 22, "symptom": "BGP scanner unresponsive", "description": "Routing process 'bgp' appears hung (pid=2687), stuck for ~22 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "routing_process": "bgp", "pid": 2687, "stuck_minutes": 22}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T15:11:06.285930Z", "interface": "TenGigabitEthernet1/2", "class": "VIDEO", "drop_rate_pct": 17, "current_rate_kbps": 5000, "suggested_rate_kbps": 15000, "reason": "burst too small", "description": "Policing drops on TenGigabitEthernet1/2 class=VIDEO. Current rate 5000 kbps; drops due to burst too small."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "class": "VIDEO", "current_rate_kbps": 5000, "suggested_rate_kbps": 15000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 15000 64000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T20:45:06.288155Z", "interface": "TenGigabitEthernet1/2", "class": "DATA", "drop_rate_pct": 13, "current_rate_kbps": 10000, "suggested_rate_kbps": 20000, "reason": "token bucket depleted", "description": "Policing drops on TenGigabitEthernet1/2 class=DATA. Current rate 10000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "class": "DATA", "current_rate_kbps": 10000, "suggested_rate_kbps": 20000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 20000 16000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T13:44:06.284587Z", "interface": "GigabitEthernet0/0", "application": "voice", "expected_dscp": "cs0", "observed_dscp": "cs3", "vlan": 10, "description": "QoS misclassification on GigabitEthernet0/0: app=voice, expected DSCP=cs0, observed DSCP=cs3 (VLAN 10)."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "vlan": 10, "expected_dscp": "cs0", "observed_dscp": "cs3"}], "cli_fix": ["class-map match-any CM_DCR1_Gi00", " match vlan 10", "policy-map PM_DCR1_Gi00", " class CM_DCR1_Gi00", "  set dscp cs0", "interface GigabitEthernet0/0", " service-policy input PM_DCR1_Gi00", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T21:05:06.280874Z", "routing_process": "ospf", "pid": 4190, "stuck_minutes": 27, "symptom": "Adjacency state not progressing", "description": "Routing process 'ospf' appears hung (pid=4190), stuck for ~27 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios_xe", "routing_process": "ospf", "pid": 4190, "stuck_minutes": 27}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:34:06.283711Z", "interface": "GigabitEthernet1/0", "application": "web", "expected_dscp": "ef", "observed_dscp": "af31", "vlan": 40, "description": "QoS misclassification on GigabitEthernet1/0: app=web, expected DSCP=ef, observed DSCP=af31 (VLAN 40)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "vlan": 40, "expected_dscp": "ef", "observed_dscp": "af31"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi10", " match vlan 40", "policy-map PM_BRANCH_Gi10", " class CM_BRANCH_Gi10", "  set dscp ef", "interface GigabitEthernet1/0", " service-policy input PM_BRANCH_Gi10", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T12:42:06.283448Z", "interface": "GigabitEthernet0/0", "application": "video", "expected_dscp": "af21", "observed_dscp": "af41", "vlan": 20, "description": "QoS misclassification on GigabitEthernet0/0: app=video, expected DSCP=af21, observed DSCP=af41 (VLAN 20)."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "vlan": 20, "expected_dscp": "af21", "observed_dscp": "af41"}], "cli_fix": ["class-map match-any CM_DCR1_Gi00", " match vlan 20", "policy-map PM_DCR1_Gi00", " class CM_DCR1_Gi00", "  set dscp af21", "interface GigabitEthernet0/0", " service-policy input PM_DCR1_Gi00", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T14:52:06.286025Z", "interface": "GigabitEthernet1/0", "class": "BULK", "drop_rate_pct": 8, "current_rate_kbps": 2000, "suggested_rate_kbps": 6000, "reason": "rate too low", "description": "Policing drops on GigabitEthernet1/0 class=BULK. Current rate 2000 kbps; drops due to rate too low."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "class": "BULK", "current_rate_kbps": 2000, "suggested_rate_kbps": 6000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 6000 8000 conform-action transmit exceed-action drop", "interface GigabitEthernet1/0", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T18:32:06.286491Z", "interface": "TenGigabitEthernet1/1", "class": "BULK", "drop_rate_pct": 17, "current_rate_kbps": 20000, "suggested_rate_kbps": 40000, "reason": "policer exceed drops", "description": "Policing drops on TenGigabitEthernet1/1 class=BULK. Current rate 20000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "class": "BULK", "current_rate_kbps": 20000, "suggested_rate_kbps": 40000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 40000 32000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T18:47:06.287460Z", "interface": "TenGigabitEthernet1/2", "class": "VIDEO", "drop_rate_pct": 6, "current_rate_kbps": 10000, "suggested_rate_kbps": 20000, "reason": "rate too low", "description": "Policing drops on TenGigabitEthernet1/2 class=VIDEO. Current rate 10000 kbps; drops due to rate too low."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "class": "VIDEO", "current_rate_kbps": 10000, "suggested_rate_kbps": 20000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 20000 8000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T17:56:06.286065Z", "interface": "TenGigabitEthernet1/2", "class": "VOICE", "drop_rate_pct": 14, "current_rate_kbps": 1000, "suggested_rate_kbps": 3000, "reason": "burst too small", "description": "Policing drops on TenGigabitEthernet1/2 class=VOICE. Current rate 1000 kbps; drops due to burst too small."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "class": "VOICE", "current_rate_kbps": 1000, "suggested_rate_kbps": 3000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 3000 32000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T20:43:06.279976Z", "routing_process": "bgp", "pid": 1494, "stuck_minutes": 23, "symptom": "Routing table not updating", "description": "Routing process 'bgp' appears hung (pid=1494), stuck for ~23 minutes. Symptom: Routing table not updating."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "routing_process": "bgp", "pid": 1494, "stuck_minutes": 23}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T15:22:06.281531Z", "routing_process": "bgp", "pid": 654, "stuck_minutes": 19, "symptom": "RIB update stalled", "description": "Routing process 'bgp' appears hung (pid=654), stuck for ~19 minutes. Symptom: RIB update stalled."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "routing_process": "bgp", "pid": 654, "stuck_minutes": 19}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T14:36:06.281129Z", "routing_process": "isis", "pid": 2535, "stuck_minutes": 40, "symptom": "Routing table not updating", "description": "Routing process 'isis' appears hung (pid=2535), stuck for ~40 minutes. Symptom: Routing table not updating."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "routing_process": "isis", "pid": 2535, "stuck_minutes": 40}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T11:54:06.281306Z", "routing_process": "bgp", "pid": 4015, "stuck_minutes": 39, "symptom": "BGP scanner unresponsive", "description": "Routing process 'bgp' appears hung (pid=4015), stuck for ~39 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "routing_process": "bgp", "pid": 4015, "stuck_minutes": 39}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T19:18:06.280585Z", "routing_process": "bgp", "pid": 304, "stuck_minutes": 41, "symptom": "SPF calculation stuck", "description": "Routing process 'bgp' appears hung (pid=304), stuck for ~41 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "routing_process": "bgp", "pid": 304, "stuck_minutes": 41}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T15:47:06.282799Z", "interface": "TenGigabitEthernet1/2", "application": "web", "expected_dscp": "ef", "observed_dscp": "af21", "vlan": 20, "description": "QoS misclassification on TenGigabitEthernet1/2: app=web, expected DSCP=ef, observed DSCP=af21 (VLAN 20)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "vlan": 20, "expected_dscp": "ef", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_EDGERT_TenGi12", " match vlan 20", "policy-map PM_EDGERT_TenGi12", " class CM_EDGERT_TenGi12", "  set dscp ef", "interface TenGigabitEthernet1/2", " service-policy input PM_EDGERT_TenGi12", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T19:18:06.286018Z", "interface": "GigabitEthernet0/0", "class": "VIDEO", "drop_rate_pct": 35, "current_rate_kbps": 5000, "suggested_rate_kbps": 10000, "reason": "rate too low", "description": "Policing drops on GigabitEthernet0/0 class=VIDEO. Current rate 5000 kbps; drops due to rate too low."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "class": "VIDEO", "current_rate_kbps": 5000, "suggested_rate_kbps": 10000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 10000 32000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/0", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T18:27:06.281229Z", "routing_process": "eigrp", "pid": 4157, "stuck_minutes": 17, "symptom": "Adjacency state not progressing", "description": "Routing process 'eigrp' appears hung (pid=4157), stuck for ~17 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "routing_process": "eigrp", "pid": 4157, "stuck_minutes": 17}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T19:35:06.284215Z", "interface": "GigabitEthernet1/0", "application": "web", "expected_dscp": "af21", "observed_dscp": "af31", "vlan": 10, "description": "QoS misclassification on GigabitEthernet1/0: app=web, expected DSCP=af21, observed DSCP=af31 (VLAN 10)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "vlan": 10, "expected_dscp": "af21", "observed_dscp": "af31"}], "cli_fix": ["class-map match-any CM_EDGERT_Gi10", " match vlan 10", "policy-map PM_EDGERT_Gi10", " class CM_EDGERT_Gi10", "  set dscp af21", "interface GigabitEthernet1/0", " service-policy input PM_EDGERT_Gi10", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T21:33:06.284142Z", "interface": "TenGigabitEthernet1/1", "application": "web", "expected_dscp": "cs3", "observed_dscp": "af31", "vlan": 20, "description": "QoS misclassification on TenGigabitEthernet1/1: app=web, expected DSCP=cs3, observed DSCP=af31 (VLAN 20)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "vlan": 20, "expected_dscp": "cs3", "observed_dscp": "af31"}], "cli_fix": ["class-map match-any CM_BRANCH_TenGi11", " match vlan 20", "policy-map PM_BRANCH_TenGi11", " class CM_BRANCH_TenGi11", "  set dscp cs3", "interface TenGigabitEthernet1/1", " service-policy input PM_BRANCH_TenGi11", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T21:28:06.280019Z", "routing_process": "eigrp", "pid": 1662, "stuck_minutes": 7, "symptom": "Adjacency state not progressing", "description": "Routing process 'eigrp' appears hung (pid=1662), stuck for ~7 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "routing_process": "eigrp", "pid": 1662, "stuck_minutes": 7}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T13:39:06.283322Z", "interface": "GigabitEthernet1/0", "application": "erp", "expected_dscp": "cs3", "observed_dscp": "af41", "vlan": 10, "description": "QoS misclassification on GigabitEthernet1/0: app=erp, expected DSCP=cs3, observed DSCP=af41 (VLAN 10)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "vlan": 10, "expected_dscp": "cs3", "observed_dscp": "af41"}], "cli_fix": ["class-map match-any CM_CORER2_Gi10", " match vlan 10", "policy-map PM_CORER2_Gi10", " class CM_CORER2_Gi10", "  set dscp cs3", "interface GigabitEthernet1/0", " service-policy input PM_CORER2_Gi10", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T13:57:06.280104Z", "routing_process": "isis", "pid": 3671, "stuck_minutes": 17, "symptom": "RIB update stalled", "description": "Routing process 'isis' appears hung (pid=3671), stuck for ~17 minutes. Symptom: RIB update stalled."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "routing_process": "isis", "pid": 3671, "stuck_minutes": 17}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T20:31:06.287631Z", "interface": "TenGigabitEthernet1/2", "class": "VOICE", "drop_rate_pct": 34, "current_rate_kbps": 20000, "suggested_rate_kbps": 40000, "reason": "rate too low", "description": "Policing drops on TenGigabitEthernet1/2 class=VOICE. Current rate 20000 kbps; drops due to rate too low."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "class": "VOICE", "current_rate_kbps": 20000, "suggested_rate_kbps": 40000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 40000 16000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:15:06.287139Z", "interface": "GigabitEthernet0/1", "class": "VOICE", "drop_rate_pct": 13, "current_rate_kbps": 2000, "suggested_rate_kbps": 4000, "reason": "rate too low", "description": "Policing drops on GigabitEthernet0/1 class=VOICE. Current rate 2000 kbps; drops due to rate too low."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "class": "VOICE", "current_rate_kbps": 2000, "suggested_rate_kbps": 4000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 4000 32000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T20:21:06.284572Z", "interface": "GigabitEthernet0/1", "application": "web", "expected_dscp": "cs3", "observed_dscp": "cs0", "vlan": 30, "description": "QoS misclassification on GigabitEthernet0/1: app=web, expected DSCP=cs3, observed DSCP=cs0 (VLAN 30)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "vlan": 30, "expected_dscp": "cs3", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_CORER2_Gi01", " match vlan 30", "policy-map PM_CORER2_Gi01", " class CM_CORER2_Gi01", "  set dscp cs3", "interface GigabitEthernet0/1", " service-policy input PM_CORER2_Gi01", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T19:42:06.280681Z", "routing_process": "eigrp", "pid": 2443, "stuck_minutes": 27, "symptom": "Adjacency state not progressing", "description": "Routing process 'eigrp' appears hung (pid=2443), stuck for ~27 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios_xe", "routing_process": "eigrp", "pid": 2443, "stuck_minutes": 27}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:47:06.284479Z", "interface": "GigabitEthernet0/1", "application": "voice", "expected_dscp": "cs3", "observed_dscp": "af41", "vlan": 50, "description": "QoS misclassification on GigabitEthernet0/1: app=voice, expected DSCP=cs3, observed DSCP=af41 (VLAN 50)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "vlan": 50, "expected_dscp": "cs3", "observed_dscp": "af41"}], "cli_fix": ["class-map match-any CM_EDGERT_Gi01", " match vlan 50", "policy-map PM_EDGERT_Gi01", " class CM_EDGERT_Gi01", "  set dscp cs3", "interface GigabitEthernet0/1", " service-policy input PM_EDGERT_Gi01", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T15:43:06.280085Z", "routing_process": "isis", "pid": 3203, "stuck_minutes": 11, "symptom": "RIB update stalled", "description": "Routing process 'isis' appears hung (pid=3203), stuck for ~11 minutes. Symptom: RIB update stalled."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "routing_process": "isis", "pid": 3203, "stuck_minutes": 11}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T16:14:06.287967Z", "interface": "GigabitEthernet1/0", "class": "VOICE", "drop_rate_pct": 10, "current_rate_kbps": 20000, "suggested_rate_kbps": 40000, "reason": "burst too small", "description": "Policing drops on GigabitEthernet1/0 class=VOICE. Current rate 20000 kbps; drops due to burst too small."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "class": "VOICE", "current_rate_kbps": 20000, "suggested_rate_kbps": 40000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 40000 8000 conform-action transmit exceed-action drop", "interface GigabitEthernet1/0", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T17:34:06.281524Z", "routing_process": "ospf", "pid": 2168, "stuck_minutes": 38, "symptom": "BGP scanner unresponsive", "description": "Routing process 'ospf' appears hung (pid=2168), stuck for ~38 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "routing_process": "ospf", "pid": 2168, "stuck_minutes": 38}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T20:17:06.286538Z", "interface": "GigabitEthernet0/0", "class": "DATA", "drop_rate_pct": 10, "current_rate_kbps": 2000, "suggested_rate_kbps": 6000, "reason": "token bucket depleted", "description": "Policing drops on GigabitEthernet0/0 class=DATA. Current rate 2000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "class": "DATA", "current_rate_kbps": 2000, "suggested_rate_kbps": 6000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 6000 8000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/0", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T21:34:06.280746Z", "routing_process": "isis", "pid": 1944, "stuck_minutes": 12, "symptom": "Adjacency state not progressing", "description": "Routing process 'isis' appears hung (pid=1944), stuck for ~12 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios_xe", "routing_process": "isis", "pid": 1944, "stuck_minutes": 12}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:18:06.280535Z", "routing_process": "bgp", "pid": 2417, "stuck_minutes": 22, "symptom": "BGP scanner unresponsive", "description": "Routing process 'bgp' appears hung (pid=2417), stuck for ~22 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios", "routing_process": "bgp", "pid": 2417, "stuck_minutes": 22}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T20:10:06.280341Z", "routing_process": "eigrp", "pid": 3695, "stuck_minutes": 24, "symptom": "SPF calculation stuck", "description": "Routing process 'eigrp' appears hung (pid=3695), stuck for ~24 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "routing_process": "eigrp", "pid": 3695, "stuck_minutes": 24}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T18:32:06.287410Z", "interface": "GigabitEthernet1/0", "class": "DATA", "drop_rate_pct": 15, "current_rate_kbps": 1000, "suggested_rate_kbps": 3000, "reason": "burst too small", "description": "Policing drops on GigabitEthernet1/0 class=DATA. Current rate 1000 kbps; drops due to burst too small."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "class": "DATA", "current_rate_kbps": 1000, "suggested_rate_kbps": 3000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 3000 64000 conform-action transmit exceed-action drop", "interface GigabitEthernet1/0", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T14:28:06.284605Z", "interface": "GigabitEthernet0/0", "application": "backup", "expected_dscp": "af21", "observed_dscp": "af41", "vlan": 40, "description": "QoS misclassification on GigabitEthernet0/0: app=backup, expected DSCP=af21, observed DSCP=af41 (VLAN 40)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "vlan": 40, "expected_dscp": "af21", "observed_dscp": "af41"}], "cli_fix": ["class-map match-any CM_CORER2_Gi00", " match vlan 40", "policy-map PM_CORER2_Gi00", " class CM_CORER2_Gi00", "  set dscp af21", "interface GigabitEthernet0/0", " service-policy input PM_CORER2_Gi00", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T21:04:06.288170Z", "interface": "GigabitEthernet1/0", "class": "VOICE", "drop_rate_pct": 40, "current_rate_kbps": 1000, "suggested_rate_kbps": 3000, "reason": "token bucket depleted", "description": "Policing drops on GigabitEthernet1/0 class=VOICE. Current rate 1000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "class": "VOICE", "current_rate_kbps": 1000, "suggested_rate_kbps": 3000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 3000 32000 conform-action transmit exceed-action drop", "interface GigabitEthernet1/0", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T18:27:06.282908Z", "interface": "GigabitEthernet0/1", "application": "web", "expected_dscp": "ef", "observed_dscp": "af21", "vlan": 50, "description": "QoS misclassification on GigabitEthernet0/1: app=web, expected DSCP=ef, observed DSCP=af21 (VLAN 50)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "vlan": 50, "expected_dscp": "ef", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi01", " match vlan 50", "policy-map PM_BRANCH_Gi01", " class CM_BRANCH_Gi01", "  set dscp ef", "interface GigabitEthernet0/1", " service-policy input PM_BRANCH_Gi01", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T12:55:06.280695Z", "routing_process": "ospf", "pid": 2746, "stuck_minutes": 12, "symptom": "Adjacency state not progressing", "description": "Routing process 'ospf' appears hung (pid=2746), stuck for ~12 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "routing_process": "ospf", "pid": 2746, "stuck_minutes": 12}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T17:08:06.281171Z", "routing_process": "eigrp", "pid": 3829, "stuck_minutes": 20, "symptom": "RIB update stalled", "description": "Routing process 'eigrp' appears hung (pid=3829), stuck for ~20 minutes. Symptom: RIB update stalled."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "routing_process": "eigrp", "pid": 3829, "stuck_minutes": 20}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T14:36:06.283440Z", "interface": "GigabitEthernet0/1", "application": "backup", "expected_dscp": "cs3", "observed_dscp": "cs0", "vlan": 10, "description": "QoS misclassification on GigabitEthernet0/1: app=backup, expected DSCP=cs3, observed DSCP=cs0 (VLAN 10)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "vlan": 10, "expected_dscp": "cs3", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi01", " match vlan 10", "policy-map PM_BRANCH_Gi01", " class CM_BRANCH_Gi01", "  set dscp cs3", "interface GigabitEthernet0/1", " service-policy input PM_BRANCH_Gi01", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T12:51:06.285755Z", "interface": "GigabitEthernet0/1", "class": "VOICE", "drop_rate_pct": 20, "current_rate_kbps": 10000, "suggested_rate_kbps": 20000, "reason": "token bucket depleted", "description": "Policing drops on GigabitEthernet0/1 class=VOICE. Current rate 10000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "class": "VOICE", "current_rate_kbps": 10000, "suggested_rate_kbps": 20000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 20000 16000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T11:42:06.288331Z", "interface": "TenGigabitEthernet1/1", "class": "VOICE", "drop_rate_pct": 19, "current_rate_kbps": 5000, "suggested_rate_kbps": 10000, "reason": "token bucket depleted", "description": "Policing drops on TenGigabitEthernet1/1 class=VOICE. Current rate 5000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "class": "VOICE", "current_rate_kbps": 5000, "suggested_rate_kbps": 10000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 10000 64000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T18:03:06.283378Z", "interface": "GigabitEthernet0/0", "application": "backup", "expected_dscp": "cs3", "observed_dscp": "cs0", "vlan": 20, "description": "QoS misclassification on GigabitEthernet0/0: app=backup, expected DSCP=cs3, observed DSCP=cs0 (VLAN 20)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "vlan": 20, "expected_dscp": "cs3", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_CORER2_Gi00", " match vlan 20", "policy-map PM_CORER2_Gi00", " class CM_CORER2_Gi00", "  set dscp cs3", "interface GigabitEthernet0/0", " service-policy input PM_CORER2_Gi00", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T17:23:06.288100Z", "interface": "TenGigabitEthernet1/1", "class": "VIDEO", "drop_rate_pct": 17, "current_rate_kbps": 10000, "suggested_rate_kbps": 20000, "reason": "policer exceed drops", "description": "Policing drops on TenGigabitEthernet1/1 class=VIDEO. Current rate 10000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "class": "VIDEO", "current_rate_kbps": 10000, "suggested_rate_kbps": 20000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 20000 32000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T21:28:06.283297Z", "interface": "TenGigabitEthernet1/1", "application": "voice", "expected_dscp": "cs3", "observed_dscp": "cs0", "vlan": 20, "description": "QoS misclassification on TenGigabitEthernet1/1: app=voice, expected DSCP=cs3, observed DSCP=cs0 (VLAN 20)."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "vlan": 20, "expected_dscp": "cs3", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_DCR1_TenGi11", " match vlan 20", "policy-map PM_DCR1_TenGi11", " class CM_DCR1_TenGi11", "  set dscp cs3", "interface TenGigabitEthernet1/1", " service-policy input PM_DCR1_TenGi11", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T12:07:06.280475Z", "routing_process": "ospf", "pid": 4098, "stuck_minutes": 28, "symptom": "Adjacency state not progressing", "description": "Routing process 'ospf' appears hung (pid=4098), stuck for ~28 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "routing_process": "ospf", "pid": 4098, "stuck_minutes": 28}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T14:38:06.285990Z", "interface": "GigabitEthernet1/0", "class": "DATA", "drop_rate_pct": 40, "current_rate_kbps": 10000, "suggested_rate_kbps": 30000, "reason": "rate too low", "description": "Policing drops on GigabitEthernet1/0 class=DATA. Current rate 10000 kbps; drops due to rate too low."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "class": "DATA", "current_rate_kbps": 10000, "suggested_rate_kbps": 30000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 30000 64000 conform-action transmit exceed-action drop", "interface GigabitEthernet1/0", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T12:37:06.281423Z", "routing_process": "bgp", "pid": 563, "stuck_minutes": 11, "symptom": "Adjacency state not progressing", "description": "Routing process 'bgp' appears hung (pid=563), stuck for ~11 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "routing_process": "bgp", "pid": 563, "stuck_minutes": 11}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T20:35:06.284982Z", "interface": "TenGigabitEthernet1/2", "application": "voice", "expected_dscp": "af41", "observed_dscp": "cs0", "vlan": 40, "description": "QoS misclassification on TenGigabitEthernet1/2: app=voice, expected DSCP=af41, observed DSCP=cs0 (VLAN 40)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/2", "vlan": 40, "expected_dscp": "af41", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_CORER1_TenGi12", " match vlan 40", "policy-map PM_CORER1_TenGi12", " class CM_CORER1_TenGi12", "  set dscp af41", "interface TenGigabitEthernet1/2", " service-policy input PM_CORER1_TenGi12", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T17:19:06.287403Z", "interface": "TenGigabitEthernet1/2", "class": "DATA", "drop_rate_pct": 22, "current_rate_kbps": 2000, "suggested_rate_kbps": 4000, "reason": "token bucket depleted", "description": "Policing drops on TenGigabitEthernet1/2 class=DATA. Current rate 2000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/2", "class": "DATA", "current_rate_kbps": 2000, "suggested_rate_kbps": 4000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 4000 16000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T15:32:06.281417Z", "routing_process": "bgp", "pid": 4865, "stuck_minutes": 5, "symptom": "BGP scanner unresponsive", "description": "Routing process 'bgp' appears hung (pid=4865), stuck for ~5 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "routing_process": "bgp", "pid": 4865, "stuck_minutes": 5}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T14:20:06.284706Z", "interface": "GigabitEthernet0/1", "application": "backup", "expected_dscp": "af41", "observed_dscp": "ef", "vlan": 30, "description": "QoS misclassification on GigabitEthernet0/1: app=backup, expected DSCP=af41, observed DSCP=ef (VLAN 30)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "vlan": 30, "expected_dscp": "af41", "observed_dscp": "ef"}], "cli_fix": ["class-map match-any CM_CORER2_Gi01", " match vlan 30", "policy-map PM_CORER2_Gi01", " class CM_CORER2_Gi01", "  set dscp af41", "interface GigabitEthernet0/1", " service-policy input PM_CORER2_Gi01", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T19:45:06.285820Z", "interface": "TenGigabitEthernet1/1", "class": "DATA", "drop_rate_pct": 25, "current_rate_kbps": 1000, "suggested_rate_kbps": 2000, "reason": "burst too small", "description": "Policing drops on TenGigabitEthernet1/1 class=DATA. Current rate 1000 kbps; drops due to burst too small."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "class": "DATA", "current_rate_kbps": 1000, "suggested_rate_kbps": 2000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 2000 16000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T14:16:06.287308Z", "interface": "TenGigabitEthernet1/2", "class": "VIDEO", "drop_rate_pct": 39, "current_rate_kbps": 10000, "suggested_rate_kbps": 20000, "reason": "rate too low", "description": "Policing drops on TenGigabitEthernet1/2 class=VIDEO. Current rate 10000 kbps; drops due to rate too low."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "class": "VIDEO", "current_rate_kbps": 10000, "suggested_rate_kbps": 20000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 20000 64000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T11:45:06.284803Z", "interface": "TenGigabitEthernet1/2", "application": "web", "expected_dscp": "af21", "observed_dscp": "af41", "vlan": 10, "description": "QoS misclassification on TenGigabitEthernet1/2: app=web, expected DSCP=af21, observed DSCP=af41 (VLAN 10)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/2", "vlan": 10, "expected_dscp": "af21", "observed_dscp": "af41"}], "cli_fix": ["class-map match-any CM_CORER2_TenGi12", " match vlan 10", "policy-map PM_CORER2_TenGi12", " class CM_CORER2_TenGi12", "  set dscp af21", "interface TenGigabitEthernet1/2", " service-policy input PM_CORER2_TenGi12", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T20:20:06.283054Z", "interface": "GigabitEthernet0/1", "application": "backup", "expected_dscp": "af21", "observed_dscp": "cs0", "vlan": 30, "description": "QoS misclassification on GigabitEthernet0/1: app=backup, expected DSCP=af21, observed DSCP=cs0 (VLAN 30)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "vlan": 30, "expected_dscp": "af21", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_CORER2_Gi01", " match vlan 30", "policy-map PM_CORER2_Gi01", " class CM_CORER2_Gi01", "  set dscp af21", "interface GigabitEthernet0/1", " service-policy input PM_CORER2_Gi01", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T14:13:06.280523Z", "routing_process": "bgp", "pid": 1127, "stuck_minutes": 41, "symptom": "Adjacency state not progressing", "description": "Routing process 'bgp' appears hung (pid=1127), stuck for ~41 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "routing_process": "bgp", "pid": 1127, "stuck_minutes": 41}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T19:02:06.281116Z", "routing_process": "ospf", "pid": 1365, "stuck_minutes": 18, "symptom": "Adjacency state not progressing", "description": "Routing process 'ospf' appears hung (pid=1365), stuck for ~18 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "routing_process": "ospf", "pid": 1365, "stuck_minutes": 18}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T21:27:06.283514Z", "interface": "GigabitEthernet0/1", "application": "web", "expected_dscp": "cs0", "observed_dscp": "cs3", "vlan": 20, "description": "QoS misclassification on GigabitEthernet0/1: app=web, expected DSCP=cs0, observed DSCP=cs3 (VLAN 20)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "vlan": 20, "expected_dscp": "cs0", "observed_dscp": "cs3"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi01", " match vlan 20", "policy-map PM_BRANCH_Gi01", " class CM_BRANCH_Gi01", "  set dscp cs0", "interface GigabitEthernet0/1", " service-policy input PM_BRANCH_Gi01", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T19:05:06.287050Z", "interface": "TenGigabitEthernet1/1", "class": "BULK", "drop_rate_pct": 24, "current_rate_kbps": 20000, "suggested_rate_kbps": 40000, "reason": "token bucket depleted", "description": "Policing drops on TenGigabitEthernet1/1 class=BULK. Current rate 20000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "class": "BULK", "current_rate_kbps": 20000, "suggested_rate_kbps": 40000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 40000 64000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T12:21:06.286612Z", "interface": "GigabitEthernet0/1", "class": "BULK", "drop_rate_pct": 26, "current_rate_kbps": 1000, "suggested_rate_kbps": 2000, "reason": "token bucket depleted", "description": "Policing drops on GigabitEthernet0/1 class=BULK. Current rate 1000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "class": "BULK", "current_rate_kbps": 1000, "suggested_rate_kbps": 2000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 2000 64000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T17:44:06.282692Z", "interface": "GigabitEthernet0/1", "application": "backup", "expected_dscp": "cs0", "observed_dscp": "ef", "vlan": 20, "description": "QoS misclassification on GigabitEthernet0/1: app=backup, expected DSCP=cs0, observed DSCP=ef (VLAN 20)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "vlan": 20, "expected_dscp": "cs0", "observed_dscp": "ef"}], "cli_fix": ["class-map match-any CM_EDGERT_Gi01", " match vlan 20", "policy-map PM_EDGERT_Gi01", " class CM_EDGERT_Gi01", "  set dscp cs0", "interface GigabitEthernet0/1", " service-policy input PM_EDGERT_Gi01", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T14:25:06.281165Z", "routing_process": "bgp", "pid": 1224, "stuck_minutes": 22, "symptom": "Adjacency state not progressing", "description": "Routing process 'bgp' appears hung (pid=1224), stuck for ~22 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "routing_process": "bgp", "pid": 1224, "stuck_minutes": 22}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:20:06.279910Z", "routing_process": "eigrp", "pid": 303, "stuck_minutes": 4, "symptom": "SPF calculation stuck", "description": "Routing process 'eigrp' appears hung (pid=303), stuck for ~4 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "routing_process": "eigrp", "pid": 303, "stuck_minutes": 4}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T13:56:06.287688Z", "interface": "TenGigabitEthernet1/1", "class": "VIDEO", "drop_rate_pct": 28, "current_rate_kbps": 10000, "suggested_rate_kbps": 20000, "reason": "policer exceed drops", "description": "Policing drops on TenGigabitEthernet1/1 class=VIDEO. Current rate 10000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "class": "VIDEO", "current_rate_kbps": 10000, "suggested_rate_kbps": 20000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 20000 32000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T19:41:06.281122Z", "routing_process": "isis", "pid": 1696, "stuck_minutes": 38, "symptom": "RIB update stalled", "description": "Routing process 'isis' appears hung (pid=1696), stuck for ~38 minutes. Symptom: RIB update stalled."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios_xe", "routing_process": "isis", "pid": 1696, "stuck_minutes": 38}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T15:24:06.281034Z", "routing_process": "bgp", "pid": 1014, "stuck_minutes": 5, "symptom": "Routing table not updating", "description": "Routing process 'bgp' appears hung (pid=1014), stuck for ~5 minutes. Symptom: Routing table not updating."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "routing_process": "bgp", "pid": 1014, "stuck_minutes": 5}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T19:55:06.284755Z", "interface": "GigabitEthernet0/1", "application": "voice", "expected_dscp": "cs3", "observed_dscp": "af41", "vlan": 10, "description": "QoS misclassification on GigabitEthernet0/1: app=voice, expected DSCP=cs3, observed DSCP=af41 (VLAN 10)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "vlan": 10, "expected_dscp": "cs3", "observed_dscp": "af41"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi01", " match vlan 10", "policy-map PM_BRANCH_Gi01", " class CM_BRANCH_Gi01", "  set dscp cs3", "interface GigabitEthernet0/1", " service-policy input PM_BRANCH_Gi01", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T12:07:06.280349Z", "routing_process": "eigrp", "pid": 4646, "stuck_minutes": 37, "symptom": "Adjacency state not progressing", "description": "Routing process 'eigrp' appears hung (pid=4646), stuck for ~37 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "routing_process": "eigrp", "pid": 4646, "stuck_minutes": 37}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:43:06.279652Z", "routing_process": "isis", "pid": 3507, "stuck_minutes": 25, "symptom": "SPF calculation stuck", "description": "Routing process 'isis' appears hung (pid=3507), stuck for ~25 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios_xe", "routing_process": "isis", "pid": 3507, "stuck_minutes": 25}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T13:19:06.286500Z", "interface": "GigabitEthernet1/0", "class": "BULK", "drop_rate_pct": 5, "current_rate_kbps": 5000, "suggested_rate_kbps": 10000, "reason": "policer exceed drops", "description": "Policing drops on GigabitEthernet1/0 class=BULK. Current rate 5000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "class": "BULK", "current_rate_kbps": 5000, "suggested_rate_kbps": 10000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 10000 32000 conform-action transmit exceed-action drop", "interface GigabitEthernet1/0", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T13:51:06.288071Z", "interface": "GigabitEthernet1/0", "class": "DATA", "drop_rate_pct": 38, "current_rate_kbps": 5000, "suggested_rate_kbps": 15000, "reason": "rate too low", "description": "Policing drops on GigabitEthernet1/0 class=DATA. Current rate 5000 kbps; drops due to rate too low."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "class": "DATA", "current_rate_kbps": 5000, "suggested_rate_kbps": 15000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 15000 64000 conform-action transmit exceed-action drop", "interface GigabitEthernet1/0", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T14:36:06.281313Z", "routing_process": "eigrp", "pid": 3312, "stuck_minutes": 10, "symptom": "SPF calculation stuck", "description": "Routing process 'eigrp' appears hung (pid=3312), stuck for ~10 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "routing_process": "eigrp", "pid": 3312, "stuck_minutes": 10}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:24:06.287102Z", "interface": "TenGigabitEthernet1/1", "class": "VOICE", "drop_rate_pct": 30, "current_rate_kbps": 1000, "suggested_rate_kbps": 2000, "reason": "token bucket depleted", "description": "Policing drops on TenGigabitEthernet1/1 class=VOICE. Current rate 1000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "class": "VOICE", "current_rate_kbps": 1000, "suggested_rate_kbps": 2000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 2000 64000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T15:39:06.282971Z", "interface": "GigabitEthernet1/0", "application": "backup", "expected_dscp": "cs3", "observed_dscp": "ef", "vlan": 20, "description": "QoS misclassification on GigabitEthernet1/0: app=backup, expected DSCP=cs3, observed DSCP=ef (VLAN 20)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "vlan": 20, "expected_dscp": "cs3", "observed_dscp": "ef"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi10", " match vlan 20", "policy-map PM_BRANCH_Gi10", " class CM_BRANCH_Gi10", "  set dscp cs3", "interface GigabitEthernet1/0", " service-policy input PM_BRANCH_Gi10", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T21:08:06.280642Z", "routing_process": "bgp", "pid": 3220, "stuck_minutes": 30, "symptom": "BGP scanner unresponsive", "description": "Routing process 'bgp' appears hung (pid=3220), stuck for ~30 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios", "routing_process": "bgp", "pid": 3220, "stuck_minutes": 30}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T14:55:06.287073Z", "interface": "TenGigabitEthernet1/2", "class": "DATA", "drop_rate_pct": 25, "current_rate_kbps": 1000, "suggested_rate_kbps": 2000, "reason": "token bucket depleted", "description": "Policing drops on TenGigabitEthernet1/2 class=DATA. Current rate 1000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/2", "class": "DATA", "current_rate_kbps": 1000, "suggested_rate_kbps": 2000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 2000 16000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T21:07:06.283913Z", "interface": "TenGigabitEthernet1/1", "application": "web", "expected_dscp": "af31", "observed_dscp": "cs0", "vlan": 30, "description": "QoS misclassification on TenGigabitEthernet1/1: app=web, expected DSCP=af31, observed DSCP=cs0 (VLAN 30)."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "vlan": 30, "expected_dscp": "af31", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_DCR1_TenGi11", " match vlan 30", "policy-map PM_DCR1_TenGi11", " class CM_DCR1_TenGi11", "  set dscp af31", "interface TenGigabitEthernet1/1", " service-policy input PM_DCR1_TenGi11", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T15:29:06.285443Z", "interface": "GigabitEthernet1/0", "class": "BULK", "drop_rate_pct": 30, "current_rate_kbps": 1000, "suggested_rate_kbps": 3000, "reason": "policer exceed drops", "description": "Policing drops on GigabitEthernet1/0 class=BULK. Current rate 1000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "class": "BULK", "current_rate_kbps": 1000, "suggested_rate_kbps": 3000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 3000 16000 conform-action transmit exceed-action drop", "interface GigabitEthernet1/0", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T15:32:06.285641Z", "interface": "GigabitEthernet0/0", "class": "BULK", "drop_rate_pct": 14, "current_rate_kbps": 5000, "suggested_rate_kbps": 15000, "reason": "rate too low", "description": "Policing drops on GigabitEthernet0/0 class=BULK. Current rate 5000 kbps; drops due to rate too low."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "class": "BULK", "current_rate_kbps": 5000, "suggested_rate_kbps": 15000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 15000 64000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/0", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T18:20:06.284646Z", "interface": "TenGigabitEthernet1/1", "application": "web", "expected_dscp": "cs0", "observed_dscp": "ef", "vlan": 50, "description": "QoS misclassification on TenGigabitEthernet1/1: app=web, expected DSCP=cs0, observed DSCP=ef (VLAN 50)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "vlan": 50, "expected_dscp": "cs0", "observed_dscp": "ef"}], "cli_fix": ["class-map match-any CM_BRANCH_TenGi11", " match vlan 50", "policy-map PM_BRANCH_TenGi11", " class CM_BRANCH_TenGi11", "  set dscp cs0", "interface TenGigabitEthernet1/1", " service-policy input PM_BRANCH_TenGi11", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T18:57:06.282569Z", "interface": "TenGigabitEthernet1/2", "application": "erp", "expected_dscp": "af31", "observed_dscp": "af41", "vlan": 30, "description": "QoS misclassification on TenGigabitEthernet1/2: app=erp, expected DSCP=af31, observed DSCP=af41 (VLAN 30)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/2", "vlan": 30, "expected_dscp": "af31", "observed_dscp": "af41"}], "cli_fix": ["class-map match-any CM_EDGERT_TenGi12", " match vlan 30", "policy-map PM_EDGERT_TenGi12", " class CM_EDGERT_TenGi12", "  set dscp af31", "interface TenGigabitEthernet1/2", " service-policy input PM_EDGERT_TenGi12", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T19:46:06.286440Z", "interface": "TenGigabitEthernet1/1", "class": "DATA", "drop_rate_pct": 27, "current_rate_kbps": 10000, "suggested_rate_kbps": 30000, "reason": "rate too low", "description": "Policing drops on TenGigabitEthernet1/1 class=DATA. Current rate 10000 kbps; drops due to rate too low."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "class": "DATA", "current_rate_kbps": 10000, "suggested_rate_kbps": 30000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 30000 8000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T15:04:06.285163Z", "interface": "GigabitEthernet0/0", "application": "erp", "expected_dscp": "af31", "observed_dscp": "cs3", "vlan": 30, "description": "QoS misclassification on GigabitEthernet0/0: app=erp, expected DSCP=af31, observed DSCP=cs3 (VLAN 30)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "vlan": 30, "expected_dscp": "af31", "observed_dscp": "cs3"}], "cli_fix": ["class-map match-any CM_CORER1_Gi00", " match vlan 30", "policy-map PM_CORER1_Gi00", " class CM_CORER1_Gi00", "  set dscp af31", "interface GigabitEthernet0/0", " service-policy input PM_CORER1_Gi00", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T19:06:06.287154Z", "interface": "GigabitEthernet0/1", "class": "DATA", "drop_rate_pct": 31, "current_rate_kbps": 20000, "suggested_rate_kbps": 40000, "reason": "burst too small", "description": "Policing drops on GigabitEthernet0/1 class=DATA. Current rate 20000 kbps; drops due to burst too small."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "class": "DATA", "current_rate_kbps": 20000, "suggested_rate_kbps": 40000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 40000 64000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T11:48:06.285692Z", "interface": "GigabitEthernet0/0", "class": "BULK", "drop_rate_pct": 26, "current_rate_kbps": 20000, "suggested_rate_kbps": 60000, "reason": "rate too low", "description": "Policing drops on GigabitEthernet0/0 class=BULK. Current rate 20000 kbps; drops due to rate too low."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "class": "BULK", "current_rate_kbps": 20000, "suggested_rate_kbps": 60000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 60000 32000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/0", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T19:25:06.284335Z", "interface": "GigabitEthernet0/0", "application": "web", "expected_dscp": "af41", "observed_dscp": "cs3", "vlan": 40, "description": "QoS misclassification on GigabitEthernet0/0: app=web, expected DSCP=af41, observed DSCP=cs3 (VLAN 40)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "vlan": 40, "expected_dscp": "af41", "observed_dscp": "cs3"}], "cli_fix": ["class-map match-any CM_EDGERT_Gi00", " match vlan 40", "policy-map PM_EDGERT_Gi00", " class CM_EDGERT_Gi00", "  set dscp af41", "interface GigabitEthernet0/0", " service-policy input PM_EDGERT_Gi00", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T17:20:06.283117Z", "interface": "TenGigabitEthernet1/1", "application": "backup", "expected_dscp": "ef", "observed_dscp": "cs3", "vlan": 40, "description": "QoS misclassification on TenGigabitEthernet1/1: app=backup, expected DSCP=ef, observed DSCP=cs3 (VLAN 40)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "vlan": 40, "expected_dscp": "ef", "observed_dscp": "cs3"}], "cli_fix": ["class-map match-any CM_BRANCH_TenGi11", " match vlan 40", "policy-map PM_BRANCH_TenGi11", " class CM_BRANCH_TenGi11", "  set dscp ef", "interface TenGigabitEthernet1/1", " service-policy input PM_BRANCH_TenGi11", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T13:29:06.280887Z", "routing_process": "ospf", "pid": 680, "stuck_minutes": 29, "symptom": "Adjacency state not progressing", "description": "Routing process 'ospf' appears hung (pid=680), stuck for ~29 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "routing_process": "ospf", "pid": 680, "stuck_minutes": 29}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T18:31:06.284404Z", "interface": "TenGigabitEthernet1/2", "application": "erp", "expected_dscp": "af21", "observed_dscp": "af41", "vlan": 30, "description": "QoS misclassification on TenGigabitEthernet1/2: app=erp, expected DSCP=af21, observed DSCP=af41 (VLAN 30)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/2", "vlan": 30, "expected_dscp": "af21", "observed_dscp": "af41"}], "cli_fix": ["class-map match-any CM_EDGERT_TenGi12", " match vlan 30", "policy-map PM_EDGERT_TenGi12", " class CM_EDGERT_TenGi12", "  set dscp af21", "interface TenGigabitEthernet1/2", " service-policy input PM_EDGERT_TenGi12", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:26:06.287092Z", "interface": "TenGigabitEthernet1/2", "class": "VOICE", "drop_rate_pct": 27, "current_rate_kbps": 20000, "suggested_rate_kbps": 40000, "reason": "burst too small", "description": "Policing drops on TenGigabitEthernet1/2 class=VOICE. Current rate 20000 kbps; drops due to burst too small."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "class": "VOICE", "current_rate_kbps": 20000, "suggested_rate_kbps": 40000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 40000 32000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T14:20:06.284465Z", "interface": "GigabitEthernet0/1", "application": "backup", "expected_dscp": "cs3", "observed_dscp": "cs0", "vlan": 30, "description": "QoS misclassification on GigabitEthernet0/1: app=backup, expected DSCP=cs3, observed DSCP=cs0 (VLAN 30)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "vlan": 30, "expected_dscp": "cs3", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi01", " match vlan 30", "policy-map PM_BRANCH_Gi01", " class CM_BRANCH_Gi01", "  set dscp cs3", "interface GigabitEthernet0/1", " service-policy input PM_BRANCH_Gi01", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T18:15:06.284087Z", "interface": "GigabitEthernet0/1", "application": "backup", "expected_dscp": "cs3", "observed_dscp": "af21", "vlan": 40, "description": "QoS misclassification on GigabitEthernet0/1: app=backup, expected DSCP=cs3, observed DSCP=af21 (VLAN 40)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "vlan": 40, "expected_dscp": "cs3", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_CORER2_Gi01", " match vlan 40", "policy-map PM_CORER2_Gi01", " class CM_CORER2_Gi01", "  set dscp cs3", "interface GigabitEthernet0/1", " service-policy input PM_CORER2_Gi01", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T20:15:06.283668Z", "interface": "GigabitEthernet0/0", "application": "voice", "expected_dscp": "af31", "observed_dscp": "af41", "vlan": 10, "description": "QoS misclassification on GigabitEthernet0/0: app=voice, expected DSCP=af31, observed DSCP=af41 (VLAN 10)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "vlan": 10, "expected_dscp": "af31", "observed_dscp": "af41"}], "cli_fix": ["class-map match-any CM_EDGERT_Gi00", " match vlan 10", "policy-map PM_EDGERT_Gi00", " class CM_EDGERT_Gi00", "  set dscp af31", "interface GigabitEthernet0/0", " service-policy input PM_EDGERT_Gi00", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T15:10:06.284519Z", "interface": "GigabitEthernet0/1", "application": "web", "expected_dscp": "af41", "observed_dscp": "cs0", "vlan": 10, "description": "QoS misclassification on GigabitEthernet0/1: app=web, expected DSCP=af41, observed DSCP=cs0 (VLAN 10)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "vlan": 10, "expected_dscp": "af41", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_EDGERT_Gi01", " match vlan 10", "policy-map PM_EDGERT_Gi01", " class CM_EDGERT_Gi01", "  set dscp af41", "interface GigabitEthernet0/1", " service-policy input PM_EDGERT_Gi01", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T19:55:06.282790Z", "interface": "TenGigabitEthernet1/1", "application": "video", "expected_dscp": "af41", "observed_dscp": "cs0", "vlan": 50, "description": "QoS misclassification on TenGigabitEthernet1/1: app=video, expected DSCP=af41, observed DSCP=cs0 (VLAN 50)."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "vlan": 50, "expected_dscp": "af41", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_DCR1_TenGi11", " match vlan 50", "policy-map PM_DCR1_TenGi11", " class CM_DCR1_TenGi11", "  set dscp af41", "interface TenGigabitEthernet1/1", " service-policy input PM_DCR1_TenGi11", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T16:26:06.282995Z", "interface": "GigabitEthernet0/1", "application": "video", "expected_dscp": "cs3", "observed_dscp": "af21", "vlan": 50, "description": "QoS misclassification on GigabitEthernet0/1: app=video, expected DSCP=cs3, observed DSCP=af21 (VLAN 50)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "vlan": 50, "expected_dscp": "cs3", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_CORER2_Gi01", " match vlan 50", "policy-map PM_CORER2_Gi01", " class CM_CORER2_Gi01", "  set dscp cs3", "interface GigabitEthernet0/1", " service-policy input PM_CORER2_Gi01", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T13:38:06.286359Z", "interface": "GigabitEthernet0/1", "class": "VIDEO", "drop_rate_pct": 20, "current_rate_kbps": 20000, "suggested_rate_kbps": 60000, "reason": "token bucket depleted", "description": "Policing drops on GigabitEthernet0/1 class=VIDEO. Current rate 20000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "class": "VIDEO", "current_rate_kbps": 20000, "suggested_rate_kbps": 60000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 60000 8000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T18:38:06.285458Z", "interface": "GigabitEthernet0/0", "class": "BULK", "drop_rate_pct": 7, "current_rate_kbps": 10000, "suggested_rate_kbps": 30000, "reason": "token bucket depleted", "description": "Policing drops on GigabitEthernet0/0 class=BULK. Current rate 10000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "class": "BULK", "current_rate_kbps": 10000, "suggested_rate_kbps": 30000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 30000 8000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/0", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T17:51:06.279798Z", "routing_process": "eigrp", "pid": 2802, "stuck_minutes": 27, "symptom": "SPF calculation stuck", "description": "Routing process 'eigrp' appears hung (pid=2802), stuck for ~27 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios_xe", "routing_process": "eigrp", "pid": 2802, "stuck_minutes": 27}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T17:40:06.282273Z", "interface": "TenGigabitEthernet1/1", "application": "backup", "expected_dscp": "ef", "observed_dscp": "cs3", "vlan": 30, "description": "QoS misclassification on TenGigabitEthernet1/1: app=backup, expected DSCP=ef, observed DSCP=cs3 (VLAN 30)."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "vlan": 30, "expected_dscp": "ef", "observed_dscp": "cs3"}], "cli_fix": ["class-map match-any CM_DCR1_TenGi11", " match vlan 30", "policy-map PM_DCR1_TenGi11", " class CM_DCR1_TenGi11", "  set dscp ef", "interface TenGigabitEthernet1/1", " service-policy input PM_DCR1_TenGi11", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T15:14:06.280975Z", "routing_process": "bgp", "pid": 1244, "stuck_minutes": 5, "symptom": "BGP scanner unresponsive", "description": "Routing process 'bgp' appears hung (pid=1244), stuck for ~5 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "routing_process": "bgp", "pid": 1244, "stuck_minutes": 5}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T15:20:06.283033Z", "interface": "GigabitEthernet0/0", "application": "web", "expected_dscp": "af31", "observed_dscp": "af41", "vlan": 30, "description": "QoS misclassification on GigabitEthernet0/0: app=web, expected DSCP=af31, observed DSCP=af41 (VLAN 30)."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "vlan": 30, "expected_dscp": "af31", "observed_dscp": "af41"}], "cli_fix": ["class-map match-any CM_DCR2_Gi00", " match vlan 30", "policy-map PM_DCR2_Gi00", " class CM_DCR2_Gi00", "  set dscp af31", "interface GigabitEthernet0/0", " service-policy input PM_DCR2_Gi00", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T12:02:06.282980Z", "interface": "GigabitEthernet0/0", "application": "erp", "expected_dscp": "cs0", "observed_dscp": "cs3", "vlan": 10, "description": "QoS misclassification on GigabitEthernet0/0: app=erp, expected DSCP=cs0, observed DSCP=cs3 (VLAN 10)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "vlan": 10, "expected_dscp": "cs0", "observed_dscp": "cs3"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi00", " match vlan 10", "policy-map PM_BRANCH_Gi00", " class CM_BRANCH_Gi00", "  set dscp cs0", "interface GigabitEthernet0/0", " service-policy input PM_BRANCH_Gi00", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T12:21:06.288308Z", "interface": "GigabitEthernet1/0", "class": "VIDEO", "drop_rate_pct": 10, "current_rate_kbps": 5000, "suggested_rate_kbps": 10000, "reason": "burst too small", "description": "Policing drops on GigabitEthernet1/0 class=VIDEO. Current rate 5000 kbps; drops due to burst too small."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "class": "VIDEO", "current_rate_kbps": 5000, "suggested_rate_kbps": 10000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 10000 16000 conform-action transmit exceed-action drop", "interface GigabitEthernet1/0", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T15:20:06.282732Z", "interface": "GigabitEthernet0/1", "application": "video", "expected_dscp": "cs0", "observed_dscp": "ef", "vlan": 50, "description": "QoS misclassification on GigabitEthernet0/1: app=video, expected DSCP=cs0, observed DSCP=ef (VLAN 50)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "vlan": 50, "expected_dscp": "cs0", "observed_dscp": "ef"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi01", " match vlan 50", "policy-map PM_BRANCH_Gi01", " class CM_BRANCH_Gi01", "  set dscp cs0", "interface GigabitEthernet0/1", " service-policy input PM_BRANCH_Gi01", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T12:18:06.287960Z", "interface": "GigabitEthernet0/1", "class": "DATA", "drop_rate_pct": 26, "current_rate_kbps": 5000, "suggested_rate_kbps": 10000, "reason": "rate too low", "description": "Policing drops on GigabitEthernet0/1 class=DATA. Current rate 5000 kbps; drops due to rate too low."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "class": "DATA", "current_rate_kbps": 5000, "suggested_rate_kbps": 10000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 10000 32000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T18:35:06.284616Z", "interface": "TenGigabitEthernet1/2", "application": "voice", "expected_dscp": "af21", "observed_dscp": "af31", "vlan": 50, "description": "QoS misclassification on TenGigabitEthernet1/2: app=voice, expected DSCP=af21, observed DSCP=af31 (VLAN 50)."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "vlan": 50, "expected_dscp": "af21", "observed_dscp": "af31"}], "cli_fix": ["class-map match-any CM_DCR1_TenGi12", " match vlan 50", "policy-map PM_DCR1_TenGi12", " class CM_DCR1_TenGi12", "  set dscp af21", "interface TenGigabitEthernet1/2", " service-policy input PM_DCR1_TenGi12", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T17:14:06.284511Z", "interface": "GigabitEthernet0/1", "application": "video", "expected_dscp": "af31", "observed_dscp": "cs0", "vlan": 40, "description": "QoS misclassification on GigabitEthernet0/1: app=video, expected DSCP=af31, observed DSCP=cs0 (VLAN 40)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "vlan": 40, "expected_dscp": "af31", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_CORER2_Gi01", " match vlan 40", "policy-map PM_CORER2_Gi01", " class CM_CORER2_Gi01", "  set dscp af31", "interface GigabitEthernet0/1", " service-policy input PM_CORER2_Gi01", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T19:55:06.280141Z", "routing_process": "bgp", "pid": 1654, "stuck_minutes": 45, "symptom": "Routing table not updating", "description": "Routing process 'bgp' appears hung (pid=1654), stuck for ~45 minutes. Symptom: Routing table not updating."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "routing_process": "bgp", "pid": 1654, "stuck_minutes": 45}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T14:50:06.280249Z", "routing_process": "isis", "pid": 2904, "stuck_minutes": 40, "symptom": "Adjacency state not progressing", "description": "Routing process 'isis' appears hung (pid=2904), stuck for ~40 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "routing_process": "isis", "pid": 2904, "stuck_minutes": 40}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T19:21:06.283537Z", "interface": "GigabitEthernet1/0", "application": "voice", "expected_dscp": "af31", "observed_dscp": "ef", "vlan": 30, "description": "QoS misclassification on GigabitEthernet1/0: app=voice, expected DSCP=af31, observed DSCP=ef (VLAN 30)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "vlan": 30, "expected_dscp": "af31", "observed_dscp": "ef"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi10", " match vlan 30", "policy-map PM_BRANCH_Gi10", " class CM_BRANCH_Gi10", "  set dscp af31", "interface GigabitEthernet1/0", " service-policy input PM_BRANCH_Gi10", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T15:13:06.283750Z", "interface": "GigabitEthernet0/1", "application": "erp", "expected_dscp": "af31", "observed_dscp": "af41", "vlan": 30, "description": "QoS misclassification on GigabitEthernet0/1: app=erp, expected DSCP=af31, observed DSCP=af41 (VLAN 30)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "vlan": 30, "expected_dscp": "af31", "observed_dscp": "af41"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi01", " match vlan 30", "policy-map PM_BRANCH_Gi01", " class CM_BRANCH_Gi01", "  set dscp af31", "interface GigabitEthernet0/1", " service-policy input PM_BRANCH_Gi01", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T21:01:06.283101Z", "interface": "TenGigabitEthernet1/2", "application": "backup", "expected_dscp": "af31", "observed_dscp": "cs3", "vlan": 30, "description": "QoS misclassification on TenGigabitEthernet1/2: app=backup, expected DSCP=af31, observed DSCP=cs3 (VLAN 30)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "vlan": 30, "expected_dscp": "af31", "observed_dscp": "cs3"}], "cli_fix": ["class-map match-any CM_EDGERT_TenGi12", " match vlan 30", "policy-map PM_EDGERT_TenGi12", " class CM_EDGERT_TenGi12", "  set dscp af31", "interface TenGigabitEthernet1/2", " service-policy input PM_EDGERT_TenGi12", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:39:06.287648Z", "interface": "TenGigabitEthernet1/2", "class": "DATA", "drop_rate_pct": 14, "current_rate_kbps": 20000, "suggested_rate_kbps": 60000, "reason": "rate too low", "description": "Policing drops on TenGigabitEthernet1/2 class=DATA. Current rate 20000 kbps; drops due to rate too low."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "class": "DATA", "current_rate_kbps": 20000, "suggested_rate_kbps": 60000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 60000 8000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T19:20:06.285634Z", "interface": "GigabitEthernet0/0", "class": "VIDEO", "drop_rate_pct": 7, "current_rate_kbps": 20000, "suggested_rate_kbps": 60000, "reason": "rate too low", "description": "Policing drops on GigabitEthernet0/0 class=VIDEO. Current rate 20000 kbps; drops due to rate too low."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "class": "VIDEO", "current_rate_kbps": 20000, "suggested_rate_kbps": 60000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 60000 64000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/0", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T16:39:06.283800Z", "interface": "TenGigabitEthernet1/1", "application": "voice", "expected_dscp": "af41", "observed_dscp": "cs0", "vlan": 40, "description": "QoS misclassification on TenGigabitEthernet1/1: app=voice, expected DSCP=af41, observed DSCP=cs0 (VLAN 40)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "vlan": 40, "expected_dscp": "af41", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_EDGERT_TenGi11", " match vlan 40", "policy-map PM_EDGERT_TenGi11", " class CM_EDGERT_TenGi11", "  set dscp af41", "interface TenGigabitEthernet1/1", " service-policy input PM_EDGERT_TenGi11", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:29:06.282319Z", "interface": "GigabitEthernet0/1", "application": "erp", "expected_dscp": "af21", "observed_dscp": "cs0", "vlan": 50, "description": "QoS misclassification on GigabitEthernet0/1: app=erp, expected DSCP=af21, observed DSCP=cs0 (VLAN 50)."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "vlan": 50, "expected_dscp": "af21", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_DCR2_Gi01", " match vlan 50", "policy-map PM_DCR2_Gi01", " class CM_DCR2_Gi01", "  set dscp af21", "interface GigabitEthernet0/1", " service-policy input PM_DCR2_Gi01", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T12:08:06.284117Z", "interface": "TenGigabitEthernet1/2", "application": "voice", "expected_dscp": "cs3", "observed_dscp": "af31", "vlan": 10, "description": "QoS misclassification on TenGigabitEthernet1/2: app=voice, expected DSCP=cs3, observed DSCP=af31 (VLAN 10)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "vlan": 10, "expected_dscp": "cs3", "observed_dscp": "af31"}], "cli_fix": ["class-map match-any CM_CORER1_TenGi12", " match vlan 10", "policy-map PM_CORER1_TenGi12", " class CM_CORER1_TenGi12", "  set dscp cs3", "interface TenGigabitEthernet1/2", " service-policy input PM_CORER1_TenGi12", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T20:47:06.285516Z", "interface": "TenGigabitEthernet1/2", "class": "VIDEO", "drop_rate_pct": 37, "current_rate_kbps": 1000, "suggested_rate_kbps": 3000, "reason": "token bucket depleted", "description": "Policing drops on TenGigabitEthernet1/2 class=VIDEO. Current rate 1000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/2", "class": "VIDEO", "current_rate_kbps": 1000, "suggested_rate_kbps": 3000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 3000 64000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T13:40:06.280400Z", "routing_process": "eigrp", "pid": 2937, "stuck_minutes": 34, "symptom": "RIB update stalled", "description": "Routing process 'eigrp' appears hung (pid=2937), stuck for ~34 minutes. Symptom: RIB update stalled."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "routing_process": "eigrp", "pid": 2937, "stuck_minutes": 34}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T18:52:06.280753Z", "routing_process": "isis", "pid": 871, "stuck_minutes": 4, "symptom": "SPF calculation stuck", "description": "Routing process 'isis' appears hung (pid=871), stuck for ~4 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "routing_process": "isis", "pid": 871, "stuck_minutes": 4}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T12:10:06.285150Z", "interface": "TenGigabitEthernet1/2", "application": "web", "expected_dscp": "af31", "observed_dscp": "cs3", "vlan": 10, "description": "QoS misclassification on TenGigabitEthernet1/2: app=web, expected DSCP=af31, observed DSCP=cs3 (VLAN 10)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "vlan": 10, "expected_dscp": "af31", "observed_dscp": "cs3"}], "cli_fix": ["class-map match-any CM_EDGERT_TenGi12", " match vlan 10", "policy-map PM_EDGERT_TenGi12", " class CM_EDGERT_TenGi12", "  set dscp af31", "interface TenGigabitEthernet1/2", " service-policy input PM_EDGERT_TenGi12", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T15:45:06.283564Z", "interface": "GigabitEthernet0/0", "application": "voice", "expected_dscp": "af21", "observed_dscp": "cs3", "vlan": 10, "description": "QoS misclassification on GigabitEthernet0/0: app=voice, expected DSCP=af21, observed DSCP=cs3 (VLAN 10)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "vlan": 10, "expected_dscp": "af21", "observed_dscp": "cs3"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi00", " match vlan 10", "policy-map PM_BRANCH_Gi00", " class CM_BRANCH_Gi00", "  set dscp af21", "interface GigabitEthernet0/0", " service-policy input PM_BRANCH_Gi00", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T18:09:06.287418Z", "interface": "GigabitEthernet0/0", "class": "VOICE", "drop_rate_pct": 25, "current_rate_kbps": 20000, "suggested_rate_kbps": 40000, "reason": "token bucket depleted", "description": "Policing drops on GigabitEthernet0/0 class=VOICE. Current rate 20000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "class": "VOICE", "current_rate_kbps": 20000, "suggested_rate_kbps": 40000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 40000 64000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/0", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T14:36:06.282875Z", "interface": "TenGigabitEthernet1/2", "application": "video", "expected_dscp": "cs3", "observed_dscp": "ef", "vlan": 50, "description": "QoS misclassification on TenGigabitEthernet1/2: app=video, expected DSCP=cs3, observed DSCP=ef (VLAN 50)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/2", "vlan": 50, "expected_dscp": "cs3", "observed_dscp": "ef"}], "cli_fix": ["class-map match-any CM_CORER2_TenGi12", " match vlan 50", "policy-map PM_CORER2_TenGi12", " class CM_CORER2_TenGi12", "  set dscp cs3", "interface TenGigabitEthernet1/2", " service-policy input PM_CORER2_TenGi12", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T16:02:06.282947Z", "interface": "GigabitEthernet1/0", "application": "voice", "expected_dscp": "af41", "observed_dscp": "af21", "vlan": 10, "description": "QoS misclassification on GigabitEthernet1/0: app=voice, expected DSCP=af41, observed DSCP=af21 (VLAN 10)."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "vlan": 10, "expected_dscp": "af41", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_DCR2_Gi10", " match vlan 10", "policy-map PM_DCR2_Gi10", " class CM_DCR2_Gi10", "  set dscp af41", "interface GigabitEthernet1/0", " service-policy input PM_DCR2_Gi10", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T12:12:06.287058Z", "interface": "GigabitEthernet0/0", "class": "VIDEO", "drop_rate_pct": 13, "current_rate_kbps": 20000, "suggested_rate_kbps": 40000, "reason": "token bucket depleted", "description": "Policing drops on GigabitEthernet0/0 class=VIDEO. Current rate 20000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "class": "VIDEO", "current_rate_kbps": 20000, "suggested_rate_kbps": 40000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 40000 16000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/0", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T13:24:06.280868Z", "routing_process": "bgp", "pid": 4333, "stuck_minutes": 25, "symptom": "Adjacency state not progressing", "description": "Routing process 'bgp' appears hung (pid=4333), stuck for ~25 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "routing_process": "bgp", "pid": 4333, "stuck_minutes": 25}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T13:43:06.286033Z", "interface": "TenGigabitEthernet1/1", "class": "DATA", "drop_rate_pct": 29, "current_rate_kbps": 2000, "suggested_rate_kbps": 4000, "reason": "token bucket depleted", "description": "Policing drops on TenGigabitEthernet1/1 class=DATA. Current rate 2000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "class": "DATA", "current_rate_kbps": 2000, "suggested_rate_kbps": 4000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 4000 8000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T18:16:06.281349Z", "routing_process": "isis", "pid": 4575, "stuck_minutes": 21, "symptom": "RIB update stalled", "description": "Routing process 'isis' appears hung (pid=4575), stuck for ~21 minutes. Symptom: RIB update stalled."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "routing_process": "isis", "pid": 4575, "stuck_minutes": 21}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T11:56:06.287036Z", "interface": "GigabitEthernet1/0", "class": "BULK", "drop_rate_pct": 12, "current_rate_kbps": 2000, "suggested_rate_kbps": 6000, "reason": "token bucket depleted", "description": "Policing drops on GigabitEthernet1/0 class=BULK. Current rate 2000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "class": "BULK", "current_rate_kbps": 2000, "suggested_rate_kbps": 6000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 6000 32000 conform-action transmit exceed-action drop", "interface GigabitEthernet1/0", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T11:50:06.281318Z", "routing_process": "ospf", "pid": 4708, "stuck_minutes": 12, "symptom": "BGP scanner unresponsive", "description": "Routing process 'ospf' appears hung (pid=4708), stuck for ~12 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "routing_process": "ospf", "pid": 4708, "stuck_minutes": 12}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T17:27:06.285615Z", "interface": "TenGigabitEthernet1/2", "class": "VIDEO", "drop_rate_pct": 33, "current_rate_kbps": 1000, "suggested_rate_kbps": 2000, "reason": "token bucket depleted", "description": "Policing drops on TenGigabitEthernet1/2 class=VIDEO. Current rate 1000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "class": "VIDEO", "current_rate_kbps": 1000, "suggested_rate_kbps": 2000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 2000 8000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T19:15:06.280516Z", "routing_process": "bgp", "pid": 447, "stuck_minutes": 45, "symptom": "Routing table not updating", "description": "Routing process 'bgp' appears hung (pid=447), stuck for ~45 minutes. Symptom: Routing table not updating."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "routing_process": "bgp", "pid": 447, "stuck_minutes": 45}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T18:22:06.281002Z", "routing_process": "bgp", "pid": 2808, "stuck_minutes": 42, "symptom": "Adjacency state not progressing", "description": "Routing process 'bgp' appears hung (pid=2808), stuck for ~42 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios_xe", "routing_process": "bgp", "pid": 2808, "stuck_minutes": 42}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T14:08:06.280406Z", "routing_process": "isis", "pid": 535, "stuck_minutes": 29, "symptom": "Adjacency state not progressing", "description": "Routing process 'isis' appears hung (pid=535), stuck for ~29 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "routing_process": "isis", "pid": 535, "stuck_minutes": 29}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T19:37:06.285525Z", "interface": "GigabitEthernet0/0", "class": "DATA", "drop_rate_pct": 23, "current_rate_kbps": 5000, "suggested_rate_kbps": 15000, "reason": "burst too small", "description": "Policing drops on GigabitEthernet0/0 class=DATA. Current rate 5000 kbps; drops due to burst too small."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "class": "DATA", "current_rate_kbps": 5000, "suggested_rate_kbps": 15000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 15000 64000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/0", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T17:40:06.281261Z", "routing_process": "isis", "pid": 3288, "stuck_minutes": 34, "symptom": "RIB update stalled", "description": "Routing process 'isis' appears hung (pid=3288), stuck for ~34 minutes. Symptom: RIB update stalled."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "routing_process": "isis", "pid": 3288, "stuck_minutes": 34}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T15:57:06.285126Z", "interface": "TenGigabitEthernet1/2", "application": "voice", "expected_dscp": "cs0", "observed_dscp": "af21", "vlan": 30, "description": "QoS misclassification on TenGigabitEthernet1/2: app=voice, expected DSCP=cs0, observed DSCP=af21 (VLAN 30)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "vlan": 30, "expected_dscp": "cs0", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_EDGERT_TenGi12", " match vlan 30", "policy-map PM_EDGERT_TenGi12", " class CM_EDGERT_TenGi12", "  set dscp cs0", "interface TenGigabitEthernet1/2", " service-policy input PM_EDGERT_TenGi12", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T13:32:06.280937Z", "routing_process": "ospf", "pid": 346, "stuck_minutes": 19, "symptom": "RIB update stalled", "description": "Routing process 'ospf' appears hung (pid=346), stuck for ~19 minutes. Symptom: RIB update stalled."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "routing_process": "ospf", "pid": 346, "stuck_minutes": 19}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T16:14:06.286080Z", "interface": "GigabitEthernet0/0", "class": "DATA", "drop_rate_pct": 37, "current_rate_kbps": 1000, "suggested_rate_kbps": 2000, "reason": "burst too small", "description": "Policing drops on GigabitEthernet0/0 class=DATA. Current rate 1000 kbps; drops due to burst too small."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "class": "DATA", "current_rate_kbps": 1000, "suggested_rate_kbps": 2000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 2000 32000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/0", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T14:03:06.286228Z", "interface": "GigabitEthernet1/0", "class": "VOICE", "drop_rate_pct": 14, "current_rate_kbps": 2000, "suggested_rate_kbps": 6000, "reason": "policer exceed drops", "description": "Policing drops on GigabitEthernet1/0 class=VOICE. Current rate 2000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "class": "VOICE", "current_rate_kbps": 2000, "suggested_rate_kbps": 6000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 6000 8000 conform-action transmit exceed-action drop", "interface GigabitEthernet1/0", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T11:44:06.284938Z", "interface": "TenGigabitEthernet1/1", "application": "voice", "expected_dscp": "af21", "observed_dscp": "cs3", "vlan": 50, "description": "QoS misclassification on TenGigabitEthernet1/1: app=voice, expected DSCP=af21, observed DSCP=cs3 (VLAN 50)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "vlan": 50, "expected_dscp": "af21", "observed_dscp": "cs3"}], "cli_fix": ["class-map match-any CM_CORER2_TenGi11", " match vlan 50", "policy-map PM_CORER2_TenGi11", " class CM_CORER2_TenGi11", "  set dscp af21", "interface TenGigabitEthernet1/1", " service-policy input PM_CORER2_TenGi11", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T12:59:06.280443Z", "routing_process": "isis", "pid": 309, "stuck_minutes": 10, "symptom": "Adjacency state not progressing", "description": "Routing process 'isis' appears hung (pid=309), stuck for ~10 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "routing_process": "isis", "pid": 309, "stuck_minutes": 10}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T17:34:06.287654Z", "interface": "GigabitEthernet1/0", "class": "DATA", "drop_rate_pct": 30, "current_rate_kbps": 5000, "suggested_rate_kbps": 15000, "reason": "rate too low", "description": "Policing drops on GigabitEthernet1/0 class=DATA. Current rate 5000 kbps; drops due to rate too low."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "class": "DATA", "current_rate_kbps": 5000, "suggested_rate_kbps": 15000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 15000 32000 conform-action transmit exceed-action drop", "interface GigabitEthernet1/0", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T15:06:06.287444Z", "interface": "GigabitEthernet0/1", "class": "BULK", "drop_rate_pct": 13, "current_rate_kbps": 2000, "suggested_rate_kbps": 4000, "reason": "token bucket depleted", "description": "Policing drops on GigabitEthernet0/1 class=BULK. Current rate 2000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "class": "BULK", "current_rate_kbps": 2000, "suggested_rate_kbps": 4000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 4000 8000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T21:14:06.281242Z", "routing_process": "bgp", "pid": 1902, "stuck_minutes": 16, "symptom": "BGP scanner unresponsive", "description": "Routing process 'bgp' appears hung (pid=1902), stuck for ~16 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "routing_process": "bgp", "pid": 1902, "stuck_minutes": 16}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T20:28:06.280209Z", "routing_process": "ospf", "pid": 1414, "stuck_minutes": 35, "symptom": "SPF calculation stuck", "description": "Routing process 'ospf' appears hung (pid=1414), stuck for ~35 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "routing_process": "ospf", "pid": 1414, "stuck_minutes": 35}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T13:53:06.285880Z", "interface": "GigabitEthernet1/0", "class": "VOICE", "drop_rate_pct": 29, "current_rate_kbps": 10000, "suggested_rate_kbps": 30000, "reason": "rate too low", "description": "Policing drops on GigabitEthernet1/0 class=VOICE. Current rate 10000 kbps; drops due to rate too low."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "class": "VOICE", "current_rate_kbps": 10000, "suggested_rate_kbps": 30000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 30000 8000 conform-action transmit exceed-action drop", "interface GigabitEthernet1/0", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T16:38:06.281280Z", "routing_process": "eigrp", "pid": 3315, "stuck_minutes": 3, "symptom": "Adjacency state not progressing", "description": "Routing process 'eigrp' appears hung (pid=3315), stuck for ~3 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios", "routing_process": "eigrp", "pid": 3315, "stuck_minutes": 3}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T20:07:06.286336Z", "interface": "GigabitEthernet1/0", "class": "DATA", "drop_rate_pct": 18, "current_rate_kbps": 1000, "suggested_rate_kbps": 2000, "reason": "policer exceed drops", "description": "Policing drops on GigabitEthernet1/0 class=DATA. Current rate 1000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "class": "DATA", "current_rate_kbps": 1000, "suggested_rate_kbps": 2000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 2000 8000 conform-action transmit exceed-action drop", "interface GigabitEthernet1/0", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T20:11:06.284633Z", "interface": "GigabitEthernet1/0", "application": "voice", "expected_dscp": "ef", "observed_dscp": "cs3", "vlan": 10, "description": "QoS misclassification on GigabitEthernet1/0: app=voice, expected DSCP=ef, observed DSCP=cs3 (VLAN 10)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "vlan": 10, "expected_dscp": "ef", "observed_dscp": "cs3"}], "cli_fix": ["class-map match-any CM_CORER2_Gi10", " match vlan 10", "policy-map PM_CORER2_Gi10", " class CM_CORER2_Gi10", "  set dscp ef", "interface GigabitEthernet1/0", " service-policy input PM_CORER2_Gi10", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T16:49:06.288163Z", "interface": "TenGigabitEthernet1/2", "class": "DATA", "drop_rate_pct": 21, "current_rate_kbps": 1000, "suggested_rate_kbps": 3000, "reason": "rate too low", "description": "Policing drops on TenGigabitEthernet1/2 class=DATA. Current rate 1000 kbps; drops due to rate too low."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/2", "class": "DATA", "current_rate_kbps": 1000, "suggested_rate_kbps": 3000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 3000 64000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:46:06.286053Z", "interface": "GigabitEthernet1/0", "class": "VOICE", "drop_rate_pct": 13, "current_rate_kbps": 10000, "suggested_rate_kbps": 30000, "reason": "policer exceed drops", "description": "Policing drops on GigabitEthernet1/0 class=VOICE. Current rate 10000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "class": "VOICE", "current_rate_kbps": 10000, "suggested_rate_kbps": 30000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 30000 64000 conform-action transmit exceed-action drop", "interface GigabitEthernet1/0", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T18:02:06.286522Z", "interface": "GigabitEthernet0/0", "class": "VOICE", "drop_rate_pct": 24, "current_rate_kbps": 2000, "suggested_rate_kbps": 4000, "reason": "burst too small", "description": "Policing drops on GigabitEthernet0/0 class=VOICE. Current rate 2000 kbps; drops due to burst too small."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "class": "VOICE", "current_rate_kbps": 2000, "suggested_rate_kbps": 4000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 4000 32000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/0", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T16:02:06.281543Z", "routing_process": "bgp", "pid": 2530, "stuck_minutes": 25, "symptom": "RIB update stalled", "description": "Routing process 'bgp' appears hung (pid=2530), stuck for ~25 minutes. Symptom: RIB update stalled."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "routing_process": "bgp", "pid": 2530, "stuck_minutes": 25}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T11:54:06.286989Z", "interface": "TenGigabitEthernet1/2", "class": "VOICE", "drop_rate_pct": 24, "current_rate_kbps": 5000, "suggested_rate_kbps": 10000, "reason": "policer exceed drops", "description": "Policing drops on TenGigabitEthernet1/2 class=VOICE. Current rate 5000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "class": "VOICE", "current_rate_kbps": 5000, "suggested_rate_kbps": 10000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 10000 32000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T19:43:06.280268Z", "routing_process": "eigrp", "pid": 478, "stuck_minutes": 31, "symptom": "RIB update stalled", "description": "Routing process 'eigrp' appears hung (pid=478), stuck for ~31 minutes. Symptom: RIB update stalled."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios", "routing_process": "eigrp", "pid": 478, "stuck_minutes": 31}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T20:57:06.282364Z", "interface": "TenGigabitEthernet1/1", "application": "voice", "expected_dscp": "af41", "observed_dscp": "cs0", "vlan": 40, "description": "QoS misclassification on TenGigabitEthernet1/1: app=voice, expected DSCP=af41, observed DSCP=cs0 (VLAN 40)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "vlan": 40, "expected_dscp": "af41", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_BRANCH_TenGi11", " match vlan 40", "policy-map PM_BRANCH_TenGi11", " class CM_BRANCH_TenGi11", "  set dscp af41", "interface TenGigabitEthernet1/1", " service-policy input PM_BRANCH_TenGi11", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T11:44:06.286689Z", "interface": "GigabitEthernet0/0", "class": "DATA", "drop_rate_pct": 35, "current_rate_kbps": 1000, "suggested_rate_kbps": 3000, "reason": "policer exceed drops", "description": "Policing drops on GigabitEthernet0/0 class=DATA. Current rate 1000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "class": "DATA", "current_rate_kbps": 1000, "suggested_rate_kbps": 3000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 3000 16000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/0", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T15:00:06.281924Z", "interface": "GigabitEthernet0/1", "application": "web", "expected_dscp": "cs0", "observed_dscp": "af21", "vlan": 40, "description": "QoS misclassification on GigabitEthernet0/1: app=web, expected DSCP=cs0, observed DSCP=af21 (VLAN 40)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "vlan": 40, "expected_dscp": "cs0", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_CORER1_Gi01", " match vlan 40", "policy-map PM_CORER1_Gi01", " class CM_CORER1_Gi01", "  set dscp cs0", "interface GigabitEthernet0/1", " service-policy input PM_CORER1_Gi01", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T19:26:06.287745Z", "interface": "TenGigabitEthernet1/2", "class": "DATA", "drop_rate_pct": 31, "current_rate_kbps": 1000, "suggested_rate_kbps": 2000, "reason": "burst too small", "description": "Policing drops on TenGigabitEthernet1/2 class=DATA. Current rate 1000 kbps; drops due to burst too small."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "class": "DATA", "current_rate_kbps": 1000, "suggested_rate_kbps": 2000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 2000 8000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T18:54:06.284550Z", "interface": "GigabitEthernet0/0", "application": "video", "expected_dscp": "af21", "observed_dscp": "af31", "vlan": 50, "description": "QoS misclassification on GigabitEthernet0/0: app=video, expected DSCP=af21, observed DSCP=af31 (VLAN 50)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "vlan": 50, "expected_dscp": "af21", "observed_dscp": "af31"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi00", " match vlan 50", "policy-map PM_BRANCH_Gi00", " class CM_BRANCH_Gi00", "  set dscp af21", "interface GigabitEthernet0/0", " service-policy input PM_BRANCH_Gi00", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T18:47:06.281248Z", "routing_process": "ospf", "pid": 4131, "stuck_minutes": 11, "symptom": "Adjacency state not progressing", "description": "Routing process 'ospf' appears hung (pid=4131), stuck for ~11 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios_xe", "routing_process": "ospf", "pid": 4131, "stuck_minutes": 11}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T19:42:06.285060Z", "interface": "GigabitEthernet1/0", "application": "video", "expected_dscp": "ef", "observed_dscp": "af21", "vlan": 20, "description": "QoS misclassification on GigabitEthernet1/0: app=video, expected DSCP=ef, observed DSCP=af21 (VLAN 20)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "vlan": 20, "expected_dscp": "ef", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_CORER1_Gi10", " match vlan 20", "policy-map PM_CORER1_Gi10", " class CM_CORER1_Gi10", "  set dscp ef", "interface GigabitEthernet1/0", " service-policy input PM_CORER1_Gi10", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T11:39:06.282530Z", "interface": "TenGigabitEthernet1/2", "application": "erp", "expected_dscp": "af31", "observed_dscp": "ef", "vlan": 10, "description": "QoS misclassification on TenGigabitEthernet1/2: app=erp, expected DSCP=af31, observed DSCP=ef (VLAN 10)."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "vlan": 10, "expected_dscp": "af31", "observed_dscp": "ef"}], "cli_fix": ["class-map match-any CM_DCR2_TenGi12", " match vlan 10", "policy-map PM_DCR2_TenGi12", " class CM_DCR2_TenGi12", "  set dscp af31", "interface TenGigabitEthernet1/2", " service-policy input PM_DCR2_TenGi12", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T12:12:06.279956Z", "routing_process": "ospf", "pid": 638, "stuck_minutes": 15, "symptom": "SPF calculation stuck", "description": "Routing process 'ospf' appears hung (pid=638), stuck for ~15 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios", "routing_process": "ospf", "pid": 638, "stuck_minutes": 15}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T12:54:06.287430Z", "interface": "GigabitEthernet0/0", "class": "VIDEO", "drop_rate_pct": 27, "current_rate_kbps": 1000, "suggested_rate_kbps": 2000, "reason": "token bucket depleted", "description": "Policing drops on GigabitEthernet0/0 class=VIDEO. Current rate 1000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "class": "VIDEO", "current_rate_kbps": 1000, "suggested_rate_kbps": 2000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 2000 8000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/0", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T16:21:06.280771Z", "routing_process": "bgp", "pid": 1107, "stuck_minutes": 3, "symptom": "SPF calculation stuck", "description": "Routing process 'bgp' appears hung (pid=1107), stuck for ~3 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "routing_process": "bgp", "pid": 1107, "stuck_minutes": 3}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T20:52:06.285140Z", "interface": "GigabitEthernet1/0", "application": "erp", "expected_dscp": "cs3", "observed_dscp": "af31", "vlan": 10, "description": "QoS misclassification on GigabitEthernet1/0: app=erp, expected DSCP=cs3, observed DSCP=af31 (VLAN 10)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "vlan": 10, "expected_dscp": "cs3", "observed_dscp": "af31"}], "cli_fix": ["class-map match-any CM_CORER1_Gi10", " match vlan 10", "policy-map PM_CORER1_Gi10", " class CM_CORER1_Gi10", "  set dscp cs3", "interface GigabitEthernet1/0", " service-policy input PM_CORER1_Gi10", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T19:41:06.287913Z", "interface": "TenGigabitEthernet1/2", "class": "BULK", "drop_rate_pct": 25, "current_rate_kbps": 2000, "suggested_rate_kbps": 4000, "reason": "token bucket depleted", "description": "Policing drops on TenGigabitEthernet1/2 class=BULK. Current rate 2000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "class": "BULK", "current_rate_kbps": 2000, "suggested_rate_kbps": 4000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 4000 32000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T14:15:06.281215Z", "routing_process": "eigrp", "pid": 3057, "stuck_minutes": 37, "symptom": "Adjacency state not progressing", "description": "Routing process 'eigrp' appears hung (pid=3057), stuck for ~37 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "routing_process": "eigrp", "pid": 3057, "stuck_minutes": 37}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T19:18:06.287933Z", "interface": "TenGigabitEthernet1/1", "class": "BULK", "drop_rate_pct": 20, "current_rate_kbps": 20000, "suggested_rate_kbps": 60000, "reason": "token bucket depleted", "description": "Policing drops on TenGigabitEthernet1/1 class=BULK. Current rate 20000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "class": "BULK", "current_rate_kbps": 20000, "suggested_rate_kbps": 60000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 60000 32000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T15:05:06.281147Z", "routing_process": "ospf", "pid": 1267, "stuck_minutes": 28, "symptom": "Adjacency state not progressing", "description": "Routing process 'ospf' appears hung (pid=1267), stuck for ~28 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "routing_process": "ospf", "pid": 1267, "stuck_minutes": 28}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T18:20:06.284316Z", "interface": "TenGigabitEthernet1/1", "application": "web", "expected_dscp": "af21", "observed_dscp": "ef", "vlan": 30, "description": "QoS misclassification on TenGigabitEthernet1/1: app=web, expected DSCP=af21, observed DSCP=ef (VLAN 30)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "vlan": 30, "expected_dscp": "af21", "observed_dscp": "ef"}], "cli_fix": ["class-map match-any CM_CORER1_TenGi11", " match vlan 30", "policy-map PM_CORER1_TenGi11", " class CM_CORER1_TenGi11", "  set dscp af21", "interface TenGigabitEthernet1/1", " service-policy input PM_CORER1_TenGi11", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T13:36:06.288180Z", "interface": "GigabitEthernet0/1", "class": "BULK", "drop_rate_pct": 9, "current_rate_kbps": 2000, "suggested_rate_kbps": 6000, "reason": "policer exceed drops", "description": "Policing drops on GigabitEthernet0/1 class=BULK. Current rate 2000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "class": "BULK", "current_rate_kbps": 2000, "suggested_rate_kbps": 6000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 6000 32000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T20:32:06.286406Z", "interface": "TenGigabitEthernet1/2", "class": "VOICE", "drop_rate_pct": 13, "current_rate_kbps": 5000, "suggested_rate_kbps": 10000, "reason": "rate too low", "description": "Policing drops on TenGigabitEthernet1/2 class=VOICE. Current rate 5000 kbps; drops due to rate too low."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/2", "class": "VOICE", "current_rate_kbps": 5000, "suggested_rate_kbps": 10000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 10000 16000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T16:03:06.288237Z", "interface": "TenGigabitEthernet1/1", "class": "VIDEO", "drop_rate_pct": 22, "current_rate_kbps": 20000, "suggested_rate_kbps": 40000, "reason": "burst too small", "description": "Policing drops on TenGigabitEthernet1/1 class=VIDEO. Current rate 20000 kbps; drops due to burst too small."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "class": "VIDEO", "current_rate_kbps": 20000, "suggested_rate_kbps": 40000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 40000 32000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T19:10:06.283772Z", "interface": "GigabitEthernet0/1", "application": "erp", "expected_dscp": "cs0", "observed_dscp": "af21", "vlan": 40, "description": "QoS misclassification on GigabitEthernet0/1: app=erp, expected DSCP=cs0, observed DSCP=af21 (VLAN 40)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "vlan": 40, "expected_dscp": "cs0", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_CORER2_Gi01", " match vlan 40", "policy-map PM_CORER2_Gi01", " class CM_CORER2_Gi01", "  set dscp cs0", "interface GigabitEthernet0/1", " service-policy input PM_CORER2_Gi01", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T20:03:06.280969Z", "routing_process": "eigrp", "pid": 2354, "stuck_minutes": 23, "symptom": "SPF calculation stuck", "description": "Routing process 'eigrp' appears hung (pid=2354), stuck for ~23 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios_xe", "routing_process": "eigrp", "pid": 2354, "stuck_minutes": 23}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T13:01:06.280494Z", "routing_process": "eigrp", "pid": 3294, "stuck_minutes": 31, "symptom": "Adjacency state not progressing", "description": "Routing process 'eigrp' appears hung (pid=3294), stuck for ~31 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "routing_process": "eigrp", "pid": 3294, "stuck_minutes": 31}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T17:54:06.281435Z", "routing_process": "bgp", "pid": 1549, "stuck_minutes": 16, "symptom": "Adjacency state not progressing", "description": "Routing process 'bgp' appears hung (pid=1549), stuck for ~16 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios_xe", "routing_process": "bgp", "pid": 1549, "stuck_minutes": 16}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T16:54:06.288268Z", "interface": "GigabitEthernet0/1", "class": "DATA", "drop_rate_pct": 32, "current_rate_kbps": 5000, "suggested_rate_kbps": 10000, "reason": "rate too low", "description": "Policing drops on GigabitEthernet0/1 class=DATA. Current rate 5000 kbps; drops due to rate too low."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "class": "DATA", "current_rate_kbps": 5000, "suggested_rate_kbps": 10000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 10000 16000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T17:28:06.280394Z", "routing_process": "isis", "pid": 4861, "stuck_minutes": 4, "symptom": "Routing table not updating", "description": "Routing process 'isis' appears hung (pid=4861), stuck for ~4 minutes. Symptom: Routing table not updating."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "routing_process": "isis", "pid": 4861, "stuck_minutes": 4}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T12:04:06.281078Z", "routing_process": "eigrp", "pid": 1848, "stuck_minutes": 19, "symptom": "RIB update stalled", "description": "Routing process 'eigrp' appears hung (pid=1848), stuck for ~19 minutes. Symptom: RIB update stalled."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "routing_process": "eigrp", "pid": 1848, "stuck_minutes": 19}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T21:16:06.280124Z", "routing_process": "ospf", "pid": 2652, "stuck_minutes": 40, "symptom": "Adjacency state not progressing", "description": "Routing process 'ospf' appears hung (pid=2652), stuck for ~40 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "routing_process": "ospf", "pid": 2652, "stuck_minutes": 40}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T14:00:06.286329Z", "interface": "TenGigabitEthernet1/2", "class": "BULK", "drop_rate_pct": 5, "current_rate_kbps": 10000, "suggested_rate_kbps": 20000, "reason": "burst too small", "description": "Policing drops on TenGigabitEthernet1/2 class=BULK. Current rate 10000 kbps; drops due to burst too small."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/2", "class": "BULK", "current_rate_kbps": 10000, "suggested_rate_kbps": 20000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 20000 64000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T13:12:06.283735Z", "interface": "GigabitEthernet1/0", "application": "voice", "expected_dscp": "af31", "observed_dscp": "cs3", "vlan": 50, "description": "QoS misclassification on GigabitEthernet1/0: app=voice, expected DSCP=af31, observed DSCP=cs3 (VLAN 50)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "vlan": 50, "expected_dscp": "af31", "observed_dscp": "cs3"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi10", " match vlan 50", "policy-map PM_BRANCH_Gi10", " class CM_BRANCH_Gi10", "  set dscp af31", "interface GigabitEthernet1/0", " service-policy input PM_BRANCH_Gi10", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T19:38:06.281153Z", "routing_process": "bgp", "pid": 1143, "stuck_minutes": 3, "symptom": "RIB update stalled", "description": "Routing process 'bgp' appears hung (pid=1143), stuck for ~3 minutes. Symptom: RIB update stalled."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "routing_process": "bgp", "pid": 1143, "stuck_minutes": 3}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T20:51:06.287664Z", "interface": "GigabitEthernet0/1", "class": "VOICE", "drop_rate_pct": 30, "current_rate_kbps": 10000, "suggested_rate_kbps": 30000, "reason": "policer exceed drops", "description": "Policing drops on GigabitEthernet0/1 class=VOICE. Current rate 10000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "class": "VOICE", "current_rate_kbps": 10000, "suggested_rate_kbps": 30000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 30000 64000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T15:47:06.280913Z", "routing_process": "bgp", "pid": 2225, "stuck_minutes": 42, "symptom": "BGP scanner unresponsive", "description": "Routing process 'bgp' appears hung (pid=2225), stuck for ~42 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "routing_process": "bgp", "pid": 2225, "stuck_minutes": 42}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T18:39:06.287613Z", "interface": "TenGigabitEthernet1/1", "class": "DATA", "drop_rate_pct": 10, "current_rate_kbps": 10000, "suggested_rate_kbps": 20000, "reason": "rate too low", "description": "Policing drops on TenGigabitEthernet1/1 class=DATA. Current rate 10000 kbps; drops due to rate too low."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "class": "DATA", "current_rate_kbps": 10000, "suggested_rate_kbps": 20000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 20000 16000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T13:09:06.287264Z", "interface": "TenGigabitEthernet1/1", "class": "VOICE", "drop_rate_pct": 23, "current_rate_kbps": 2000, "suggested_rate_kbps": 4000, "reason": "rate too low", "description": "Policing drops on TenGigabitEthernet1/1 class=VOICE. Current rate 2000 kbps; drops due to rate too low."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "class": "VOICE", "current_rate_kbps": 2000, "suggested_rate_kbps": 4000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 4000 16000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T13:55:06.280829Z", "routing_process": "ospf", "pid": 3751, "stuck_minutes": 16, "symptom": "SPF calculation stuck", "description": "Routing process 'ospf' appears hung (pid=3751), stuck for ~16 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "routing_process": "ospf", "pid": 3751, "stuck_minutes": 16}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T19:20:06.280611Z", "routing_process": "ospf", "pid": 1003, "stuck_minutes": 20, "symptom": "Routing table not updating", "description": "Routing process 'ospf' appears hung (pid=1003), stuck for ~20 minutes. Symptom: Routing table not updating."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "routing_process": "ospf", "pid": 1003, "stuck_minutes": 20}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T18:08:06.287085Z", "interface": "GigabitEthernet1/0", "class": "BULK", "drop_rate_pct": 32, "current_rate_kbps": 10000, "suggested_rate_kbps": 20000, "reason": "policer exceed drops", "description": "Policing drops on GigabitEthernet1/0 class=BULK. Current rate 10000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "class": "BULK", "current_rate_kbps": 10000, "suggested_rate_kbps": 20000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 20000 16000 conform-action transmit exceed-action drop", "interface GigabitEthernet1/0", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T15:13:06.284343Z", "interface": "TenGigabitEthernet1/1", "application": "backup", "expected_dscp": "af31", "observed_dscp": "af21", "vlan": 20, "description": "QoS misclassification on TenGigabitEthernet1/1: app=backup, expected DSCP=af31, observed DSCP=af21 (VLAN 20)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "vlan": 20, "expected_dscp": "af31", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_EDGERT_TenGi11", " match vlan 20", "policy-map PM_EDGERT_TenGi11", " class CM_EDGERT_TenGi11", "  set dscp af31", "interface TenGigabitEthernet1/1", " service-policy input PM_EDGERT_TenGi11", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:45:06.280111Z", "routing_process": "ospf", "pid": 1300, "stuck_minutes": 37, "symptom": "Adjacency state not progressing", "description": "Routing process 'ospf' appears hung (pid=1300), stuck for ~37 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios_xe", "routing_process": "ospf", "pid": 1300, "stuck_minutes": 37}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T13:03:06.286531Z", "interface": "GigabitEthernet0/1", "class": "DATA", "drop_rate_pct": 10, "current_rate_kbps": 5000, "suggested_rate_kbps": 10000, "reason": "policer exceed drops", "description": "Policing drops on GigabitEthernet0/1 class=DATA. Current rate 5000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "class": "DATA", "current_rate_kbps": 5000, "suggested_rate_kbps": 10000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 10000 64000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T11:38:06.285021Z", "interface": "GigabitEthernet0/0", "application": "video", "expected_dscp": "cs3", "observed_dscp": "af31", "vlan": 50, "description": "QoS misclassification on GigabitEthernet0/0: app=video, expected DSCP=cs3, observed DSCP=af31 (VLAN 50)."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "vlan": 50, "expected_dscp": "cs3", "observed_dscp": "af31"}], "cli_fix": ["class-map match-any CM_DCR1_Gi00", " match vlan 50", "policy-map PM_DCR1_Gi00", " class CM_DCR1_Gi00", "  set dscp cs3", "interface GigabitEthernet0/0", " service-policy input PM_DCR1_Gi00", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T17:47:06.281593Z", "routing_process": "bgp", "pid": 4391, "stuck_minutes": 21, "symptom": "Adjacency state not progressing", "description": "Routing process 'bgp' appears hung (pid=4391), stuck for ~21 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "routing_process": "bgp", "pid": 4391, "stuck_minutes": 21}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T14:03:06.284811Z", "interface": "GigabitEthernet0/1", "application": "backup", "expected_dscp": "af21", "observed_dscp": "af41", "vlan": 30, "description": "QoS misclassification on GigabitEthernet0/1: app=backup, expected DSCP=af21, observed DSCP=af41 (VLAN 30)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "vlan": 30, "expected_dscp": "af21", "observed_dscp": "af41"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi01", " match vlan 30", "policy-map PM_BRANCH_Gi01", " class CM_BRANCH_Gi01", "  set dscp af21", "interface GigabitEthernet0/1", " service-policy input PM_BRANCH_Gi01", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T15:26:06.284451Z", "interface": "GigabitEthernet0/1", "application": "erp", "expected_dscp": "af31", "observed_dscp": "af21", "vlan": 40, "description": "QoS misclassification on GigabitEthernet0/1: app=erp, expected DSCP=af31, observed DSCP=af21 (VLAN 40)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "vlan": 40, "expected_dscp": "af31", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi01", " match vlan 40", "policy-map PM_BRANCH_Gi01", " class CM_BRANCH_Gi01", "  set dscp af31", "interface GigabitEthernet0/1", " service-policy input PM_BRANCH_Gi01", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T17:21:06.280236Z", "routing_process": "bgp", "pid": 2819, "stuck_minutes": 42, "symptom": "Adjacency state not progressing", "description": "Routing process 'bgp' appears hung (pid=2819), stuck for ~42 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "routing_process": "bgp", "pid": 2819, "stuck_minutes": 42}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T20:36:06.282846Z", "interface": "GigabitEthernet1/0", "application": "voice", "expected_dscp": "ef", "observed_dscp": "af21", "vlan": 40, "description": "QoS misclassification on GigabitEthernet1/0: app=voice, expected DSCP=ef, observed DSCP=af21 (VLAN 40)."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "vlan": 40, "expected_dscp": "ef", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_DCR1_Gi10", " match vlan 40", "policy-map PM_DCR1_Gi10", " class CM_DCR1_Gi10", "  set dscp ef", "interface GigabitEthernet1/0", " service-policy input PM_DCR1_Gi10", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T12:49:06.286515Z", "interface": "GigabitEthernet0/1", "class": "VOICE", "drop_rate_pct": 15, "current_rate_kbps": 1000, "suggested_rate_kbps": 2000, "reason": "policer exceed drops", "description": "Policing drops on GigabitEthernet0/1 class=VOICE. Current rate 1000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "class": "VOICE", "current_rate_kbps": 1000, "suggested_rate_kbps": 2000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 2000 16000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T18:04:06.284285Z", "interface": "TenGigabitEthernet1/2", "application": "voice", "expected_dscp": "cs3", "observed_dscp": "af41", "vlan": 40, "description": "QoS misclassification on TenGigabitEthernet1/2: app=voice, expected DSCP=cs3, observed DSCP=af41 (VLAN 40)."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "vlan": 40, "expected_dscp": "cs3", "observed_dscp": "af41"}], "cli_fix": ["class-map match-any CM_DCR2_TenGi12", " match vlan 40", "policy-map PM_DCR2_TenGi12", " class CM_DCR2_TenGi12", "  set dscp cs3", "interface TenGigabitEthernet1/2", " service-policy input PM_DCR2_TenGi12", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T19:53:06.279769Z", "routing_process": "eigrp", "pid": 4553, "stuck_minutes": 37, "symptom": "SPF calculation stuck", "description": "Routing process 'eigrp' appears hung (pid=4553), stuck for ~37 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "routing_process": "eigrp", "pid": 4553, "stuck_minutes": 37}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T14:23:06.281830Z", "interface": "TenGigabitEthernet1/1", "application": "voice", "expected_dscp": "af41", "observed_dscp": "cs3", "vlan": 20, "description": "QoS misclassification on TenGigabitEthernet1/1: app=voice, expected DSCP=af41, observed DSCP=cs3 (VLAN 20)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "vlan": 20, "expected_dscp": "af41", "observed_dscp": "cs3"}], "cli_fix": ["class-map match-any CM_BRANCH_TenGi11", " match vlan 20", "policy-map PM_BRANCH_TenGi11", " class CM_BRANCH_TenGi11", "  set dscp af41", "interface TenGigabitEthernet1/1", " service-policy input PM_BRANCH_TenGi11", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T18:51:06.285416Z", "interface": "TenGigabitEthernet1/2", "class": "VIDEO", "drop_rate_pct": 15, "current_rate_kbps": 5000, "suggested_rate_kbps": 10000, "reason": "token bucket depleted", "description": "Policing drops on TenGigabitEthernet1/2 class=VIDEO. Current rate 5000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "class": "VIDEO", "current_rate_kbps": 5000, "suggested_rate_kbps": 10000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 10000 32000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T17:44:06.283370Z", "interface": "TenGigabitEthernet1/1", "application": "erp", "expected_dscp": "cs0", "observed_dscp": "af41", "vlan": 10, "description": "QoS misclassification on TenGigabitEthernet1/1: app=erp, expected DSCP=cs0, observed DSCP=af41 (VLAN 10)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "vlan": 10, "expected_dscp": "cs0", "observed_dscp": "af41"}], "cli_fix": ["class-map match-any CM_EDGERT_TenGi11", " match vlan 10", "policy-map PM_EDGERT_TenGi11", " class CM_EDGERT_TenGi11", "  set dscp cs0", "interface TenGigabitEthernet1/1", " service-policy input PM_EDGERT_TenGi11", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T12:59:06.287357Z", "interface": "GigabitEthernet0/1", "class": "VIDEO", "drop_rate_pct": 32, "current_rate_kbps": 20000, "suggested_rate_kbps": 60000, "reason": "token bucket depleted", "description": "Policing drops on GigabitEthernet0/1 class=VIDEO. Current rate 20000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "class": "VIDEO", "current_rate_kbps": 20000, "suggested_rate_kbps": 60000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 60000 32000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T15:12:06.286139Z", "interface": "GigabitEthernet0/0", "class": "BULK", "drop_rate_pct": 10, "current_rate_kbps": 20000, "suggested_rate_kbps": 60000, "reason": "burst too small", "description": "Policing drops on GigabitEthernet0/0 class=BULK. Current rate 20000 kbps; drops due to burst too small."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "class": "BULK", "current_rate_kbps": 20000, "suggested_rate_kbps": 60000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 60000 16000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/0", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T20:05:06.280701Z", "routing_process": "isis", "pid": 3930, "stuck_minutes": 34, "symptom": "BGP scanner unresponsive", "description": "Routing process 'isis' appears hung (pid=3930), stuck for ~34 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios_xe", "routing_process": "isis", "pid": 3930, "stuck_minutes": 34}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T17:48:06.280255Z", "routing_process": "ospf", "pid": 3417, "stuck_minutes": 15, "symptom": "BGP scanner unresponsive", "description": "Routing process 'ospf' appears hung (pid=3417), stuck for ~15 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios", "routing_process": "ospf", "pid": 3417, "stuck_minutes": 15}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T14:00:06.283175Z", "interface": "GigabitEthernet0/0", "application": "voice", "expected_dscp": "af21", "observed_dscp": "ef", "vlan": 10, "description": "QoS misclassification on GigabitEthernet0/0: app=voice, expected DSCP=af21, observed DSCP=ef (VLAN 10)."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "vlan": 10, "expected_dscp": "af21", "observed_dscp": "ef"}], "cli_fix": ["class-map match-any CM_DCR1_Gi00", " match vlan 10", "policy-map PM_DCR1_Gi00", " class CM_DCR1_Gi00", "  set dscp af21", "interface GigabitEthernet0/0", " service-policy input PM_DCR1_Gi00", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T13:36:06.283246Z", "interface": "GigabitEthernet0/0", "application": "video", "expected_dscp": "af21", "observed_dscp": "cs0", "vlan": 50, "description": "QoS misclassification on GigabitEthernet0/0: app=video, expected DSCP=af21, observed DSCP=cs0 (VLAN 50)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "vlan": 50, "expected_dscp": "af21", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_CORER2_Gi00", " match vlan 50", "policy-map PM_CORER2_Gi00", " class CM_CORER2_Gi00", "  set dscp af21", "interface GigabitEthernet0/0", " service-policy input PM_CORER2_Gi00", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T20:59:06.282774Z", "interface": "GigabitEthernet1/0", "application": "backup", "expected_dscp": "af21", "observed_dscp": "ef", "vlan": 30, "description": "QoS misclassification on GigabitEthernet1/0: app=backup, expected DSCP=af21, observed DSCP=ef (VLAN 30)."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "vlan": 30, "expected_dscp": "af21", "observed_dscp": "ef"}], "cli_fix": ["class-map match-any CM_DCR1_Gi10", " match vlan 30", "policy-map PM_DCR1_Gi10", " class CM_DCR1_Gi10", "  set dscp af21", "interface GigabitEthernet1/0", " service-policy input PM_DCR1_Gi10", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T18:04:06.286908Z", "interface": "GigabitEthernet1/0", "class": "DATA", "drop_rate_pct": 23, "current_rate_kbps": 5000, "suggested_rate_kbps": 15000, "reason": "policer exceed drops", "description": "Policing drops on GigabitEthernet1/0 class=DATA. Current rate 5000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "class": "DATA", "current_rate_kbps": 5000, "suggested_rate_kbps": 15000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 15000 32000 conform-action transmit exceed-action drop", "interface GigabitEthernet1/0", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T16:30:06.287945Z", "interface": "TenGigabitEthernet1/1", "class": "VIDEO", "drop_rate_pct": 32, "current_rate_kbps": 5000, "suggested_rate_kbps": 15000, "reason": "rate too low", "description": "Policing drops on TenGigabitEthernet1/1 class=VIDEO. Current rate 5000 kbps; drops due to rate too low."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "class": "VIDEO", "current_rate_kbps": 5000, "suggested_rate_kbps": 15000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 15000 32000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T15:40:06.287394Z", "interface": "GigabitEthernet0/1", "class": "DATA", "drop_rate_pct": 29, "current_rate_kbps": 20000, "suggested_rate_kbps": 60000, "reason": "rate too low", "description": "Policing drops on GigabitEthernet0/1 class=DATA. Current rate 20000 kbps; drops due to rate too low."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "class": "DATA", "current_rate_kbps": 20000, "suggested_rate_kbps": 60000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 60000 64000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T16:13:06.282939Z", "interface": "GigabitEthernet0/1", "application": "web", "expected_dscp": "af21", "observed_dscp": "af31", "vlan": 30, "description": "QoS misclassification on GigabitEthernet0/1: app=web, expected DSCP=af21, observed DSCP=af31 (VLAN 30)."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "vlan": 30, "expected_dscp": "af21", "observed_dscp": "af31"}], "cli_fix": ["class-map match-any CM_DCR1_Gi01", " match vlan 30", "policy-map PM_DCR1_Gi01", " class CM_DCR1_Gi01", "  set dscp af21", "interface GigabitEthernet0/1", " service-policy input PM_DCR1_Gi01", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T15:44:06.284222Z", "interface": "GigabitEthernet0/1", "application": "backup", "expected_dscp": "af21", "observed_dscp": "af31", "vlan": 20, "description": "QoS misclassification on GigabitEthernet0/1: app=backup, expected DSCP=af21, observed DSCP=af31 (VLAN 20)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "vlan": 20, "expected_dscp": "af21", "observed_dscp": "af31"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi01", " match vlan 20", "policy-map PM_BRANCH_Gi01", " class CM_BRANCH_Gi01", "  set dscp af21", "interface GigabitEthernet0/1", " service-policy input PM_BRANCH_Gi01", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T13:09:06.280160Z", "routing_process": "eigrp", "pid": 2156, "stuck_minutes": 28, "symptom": "BGP scanner unresponsive", "description": "Routing process 'eigrp' appears hung (pid=2156), stuck for ~28 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "routing_process": "eigrp", "pid": 2156, "stuck_minutes": 28}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T16:56:06.286414Z", "interface": "GigabitEthernet1/0", "class": "DATA", "drop_rate_pct": 35, "current_rate_kbps": 1000, "suggested_rate_kbps": 3000, "reason": "token bucket depleted", "description": "Policing drops on GigabitEthernet1/0 class=DATA. Current rate 1000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "class": "DATA", "current_rate_kbps": 1000, "suggested_rate_kbps": 3000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 3000 32000 conform-action transmit exceed-action drop", "interface GigabitEthernet1/0", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T16:45:06.286857Z", "interface": "GigabitEthernet0/0", "class": "DATA", "drop_rate_pct": 11, "current_rate_kbps": 20000, "suggested_rate_kbps": 60000, "reason": "policer exceed drops", "description": "Policing drops on GigabitEthernet0/0 class=DATA. Current rate 20000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "class": "DATA", "current_rate_kbps": 20000, "suggested_rate_kbps": 60000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 60000 16000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/0", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T18:44:06.281097Z", "routing_process": "isis", "pid": 1228, "stuck_minutes": 19, "symptom": "Routing table not updating", "description": "Routing process 'isis' appears hung (pid=1228), stuck for ~19 minutes. Symptom: Routing table not updating."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "routing_process": "isis", "pid": 1228, "stuck_minutes": 19}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T20:18:06.285560Z", "interface": "TenGigabitEthernet1/1", "class": "BULK", "drop_rate_pct": 6, "current_rate_kbps": 1000, "suggested_rate_kbps": 2000, "reason": "rate too low", "description": "Policing drops on TenGigabitEthernet1/1 class=BULK. Current rate 1000 kbps; drops due to rate too low."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "class": "BULK", "current_rate_kbps": 1000, "suggested_rate_kbps": 2000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 2000 64000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T21:23:06.279782Z", "routing_process": "eigrp", "pid": 1671, "stuck_minutes": 38, "symptom": "BGP scanner unresponsive", "description": "Routing process 'eigrp' appears hung (pid=1671), stuck for ~38 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "routing_process": "eigrp", "pid": 1671, "stuck_minutes": 38}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T16:28:06.283003Z", "interface": "TenGigabitEthernet1/1", "application": "backup", "expected_dscp": "af41", "observed_dscp": "af21", "vlan": 50, "description": "QoS misclassification on TenGigabitEthernet1/1: app=backup, expected DSCP=af41, observed DSCP=af21 (VLAN 50)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "vlan": 50, "expected_dscp": "af41", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_EDGERT_TenGi11", " match vlan 50", "policy-map PM_EDGERT_TenGi11", " class CM_EDGERT_TenGi11", "  set dscp af41", "interface TenGigabitEthernet1/1", " service-policy input PM_EDGERT_TenGi11", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T20:00:06.279755Z", "routing_process": "ospf", "pid": 4466, "stuck_minutes": 34, "symptom": "Routing table not updating", "description": "Routing process 'ospf' appears hung (pid=4466), stuck for ~34 minutes. Symptom: Routing table not updating."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "routing_process": "ospf", "pid": 4466, "stuck_minutes": 34}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T20:00:06.281696Z", "routing_process": "ospf", "pid": 4354, "stuck_minutes": 31, "symptom": "Routing table not updating", "description": "Routing process 'ospf' appears hung (pid=4354), stuck for ~31 minutes. Symptom: Routing table not updating."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "routing_process": "ospf", "pid": 4354, "stuck_minutes": 31}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T18:41:06.287587Z", "interface": "GigabitEthernet0/1", "class": "VOICE", "drop_rate_pct": 30, "current_rate_kbps": 20000, "suggested_rate_kbps": 60000, "reason": "token bucket depleted", "description": "Policing drops on GigabitEthernet0/1 class=VOICE. Current rate 20000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "class": "VOICE", "current_rate_kbps": 20000, "suggested_rate_kbps": 60000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 60000 16000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T20:38:06.284036Z", "interface": "TenGigabitEthernet1/2", "application": "backup", "expected_dscp": "af31", "observed_dscp": "af41", "vlan": 50, "description": "QoS misclassification on TenGigabitEthernet1/2: app=backup, expected DSCP=af31, observed DSCP=af41 (VLAN 50)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/2", "vlan": 50, "expected_dscp": "af31", "observed_dscp": "af41"}], "cli_fix": ["class-map match-any CM_EDGERT_TenGi12", " match vlan 50", "policy-map PM_EDGERT_TenGi12", " class CM_EDGERT_TenGi12", "  set dscp af31", "interface TenGigabitEthernet1/2", " service-policy input PM_EDGERT_TenGi12", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T17:45:06.283424Z", "interface": "GigabitEthernet1/0", "application": "voice", "expected_dscp": "cs3", "observed_dscp": "af41", "vlan": 50, "description": "QoS misclassification on GigabitEthernet1/0: app=voice, expected DSCP=cs3, observed DSCP=af41 (VLAN 50)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "vlan": 50, "expected_dscp": "cs3", "observed_dscp": "af41"}], "cli_fix": ["class-map match-any CM_CORER2_Gi10", " match vlan 50", "policy-map PM_CORER2_Gi10", " class CM_CORER2_Gi10", "  set dscp cs3", "interface GigabitEthernet1/0", " service-policy input PM_CORER2_Gi10", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T16:53:06.286778Z", "interface": "GigabitEthernet0/0", "class": "DATA", "drop_rate_pct": 22, "current_rate_kbps": 10000, "suggested_rate_kbps": 30000, "reason": "policer exceed drops", "description": "Policing drops on GigabitEthernet0/0 class=DATA. Current rate 10000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "class": "DATA", "current_rate_kbps": 10000, "suggested_rate_kbps": 30000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 30000 16000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/0", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T14:39:06.279950Z", "routing_process": "bgp", "pid": 846, "stuck_minutes": 15, "symptom": "BGP scanner unresponsive", "description": "Routing process 'bgp' appears hung (pid=846), stuck for ~15 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "routing_process": "bgp", "pid": 846, "stuck_minutes": 15}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T19:04:06.284865Z", "interface": "GigabitEthernet1/0", "application": "video", "expected_dscp": "af21", "observed_dscp": "cs0", "vlan": 50, "description": "QoS misclassification on GigabitEthernet1/0: app=video, expected DSCP=af21, observed DSCP=cs0 (VLAN 50)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "vlan": 50, "expected_dscp": "af21", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_CORER1_Gi10", " match vlan 50", "policy-map PM_CORER1_Gi10", " class CM_CORER1_Gi10", "  set dscp af21", "interface GigabitEthernet1/0", " service-policy input PM_CORER1_Gi10", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T21:18:06.279934Z", "routing_process": "bgp", "pid": 1099, "stuck_minutes": 45, "symptom": "Routing table not updating", "description": "Routing process 'bgp' appears hung (pid=1099), stuck for ~45 minutes. Symptom: Routing table not updating."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "routing_process": "bgp", "pid": 1099, "stuck_minutes": 45}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T17:45:06.280835Z", "routing_process": "eigrp", "pid": 2506, "stuck_minutes": 13, "symptom": "SPF calculation stuck", "description": "Routing process 'eigrp' appears hung (pid=2506), stuck for ~13 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "routing_process": "eigrp", "pid": 2506, "stuck_minutes": 13}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T20:03:06.282664Z", "interface": "TenGigabitEthernet1/1", "application": "web", "expected_dscp": "af41", "observed_dscp": "cs3", "vlan": 50, "description": "QoS misclassification on TenGigabitEthernet1/1: app=web, expected DSCP=af41, observed DSCP=cs3 (VLAN 50)."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "vlan": 50, "expected_dscp": "af41", "observed_dscp": "cs3"}], "cli_fix": ["class-map match-any CM_DCR2_TenGi11", " match vlan 50", "policy-map PM_DCR2_TenGi11", " class CM_DCR2_TenGi11", "  set dscp af41", "interface TenGigabitEthernet1/1", " service-policy input PM_DCR2_TenGi11", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T11:56:06.281343Z", "routing_process": "ospf", "pid": 2271, "stuck_minutes": 29, "symptom": "BGP scanner unresponsive", "description": "Routing process 'ospf' appears hung (pid=2271), stuck for ~29 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "routing_process": "ospf", "pid": 2271, "stuck_minutes": 29}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T17:23:06.285788Z", "interface": "TenGigabitEthernet1/1", "class": "DATA", "drop_rate_pct": 11, "current_rate_kbps": 20000, "suggested_rate_kbps": 40000, "reason": "policer exceed drops", "description": "Policing drops on TenGigabitEthernet1/1 class=DATA. Current rate 20000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "class": "DATA", "current_rate_kbps": 20000, "suggested_rate_kbps": 40000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 40000 8000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:48:06.280117Z", "routing_process": "eigrp", "pid": 1840, "stuck_minutes": 14, "symptom": "Routing table not updating", "description": "Routing process 'eigrp' appears hung (pid=1840), stuck for ~14 minutes. Symptom: Routing table not updating."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "routing_process": "eigrp", "pid": 1840, "stuck_minutes": 14}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T16:43:06.285747Z", "interface": "TenGigabitEthernet1/1", "class": "DATA", "drop_rate_pct": 17, "current_rate_kbps": 10000, "suggested_rate_kbps": 30000, "reason": "token bucket depleted", "description": "Policing drops on TenGigabitEthernet1/1 class=DATA. Current rate 10000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "class": "DATA", "current_rate_kbps": 10000, "suggested_rate_kbps": 30000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 30000 32000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T13:55:06.285717Z", "interface": "TenGigabitEthernet1/1", "class": "DATA", "drop_rate_pct": 6, "current_rate_kbps": 20000, "suggested_rate_kbps": 60000, "reason": "burst too small", "description": "Policing drops on TenGigabitEthernet1/1 class=DATA. Current rate 20000 kbps; drops due to burst too small."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "class": "DATA", "current_rate_kbps": 20000, "suggested_rate_kbps": 60000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 60000 32000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T20:03:06.285841Z", "interface": "GigabitEthernet0/1", "class": "VIDEO", "drop_rate_pct": 39, "current_rate_kbps": 20000, "suggested_rate_kbps": 60000, "reason": "burst too small", "description": "Policing drops on GigabitEthernet0/1 class=VIDEO. Current rate 20000 kbps; drops due to burst too small."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "class": "VIDEO", "current_rate_kbps": 20000, "suggested_rate_kbps": 60000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 60000 64000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T20:20:06.281850Z", "interface": "GigabitEthernet1/0", "application": "erp", "expected_dscp": "af41", "observed_dscp": "cs0", "vlan": 40, "description": "QoS misclassification on GigabitEthernet1/0: app=erp, expected DSCP=af41, observed DSCP=cs0 (VLAN 40)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "vlan": 40, "expected_dscp": "af41", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_EDGERT_Gi10", " match vlan 40", "policy-map PM_EDGERT_Gi10", " class CM_EDGERT_Gi10", "  set dscp af41", "interface GigabitEthernet1/0", " service-policy input PM_EDGERT_Gi10", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:10:06.281481Z", "routing_process": "bgp", "pid": 1585, "stuck_minutes": 18, "symptom": "RIB update stalled", "description": "Routing process 'bgp' appears hung (pid=1585), stuck for ~18 minutes. Symptom: RIB update stalled."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "routing_process": "bgp", "pid": 1585, "stuck_minutes": 18}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T19:29:06.285091Z", "interface": "GigabitEthernet0/0", "application": "web", "expected_dscp": "ef", "observed_dscp": "af41", "vlan": 20, "description": "QoS misclassification on GigabitEthernet0/0: app=web, expected DSCP=ef, observed DSCP=af41 (VLAN 20)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "vlan": 20, "expected_dscp": "ef", "observed_dscp": "af41"}], "cli_fix": ["class-map match-any CM_CORER1_Gi00", " match vlan 20", "policy-map PM_CORER1_Gi00", " class CM_CORER1_Gi00", "  set dscp ef", "interface GigabitEthernet0/0", " service-policy input PM_CORER1_Gi00", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T13:22:06.286240Z", "interface": "GigabitEthernet0/0", "class": "BULK", "drop_rate_pct": 17, "current_rate_kbps": 1000, "suggested_rate_kbps": 2000, "reason": "burst too small", "description": "Policing drops on GigabitEthernet0/0 class=BULK. Current rate 1000 kbps; drops due to burst too small."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "class": "BULK", "current_rate_kbps": 1000, "suggested_rate_kbps": 2000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 2000 16000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/0", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T19:37:06.283521Z", "interface": "GigabitEthernet0/1", "application": "backup", "expected_dscp": "af21", "observed_dscp": "cs0", "vlan": 10, "description": "QoS misclassification on GigabitEthernet0/1: app=backup, expected DSCP=af21, observed DSCP=cs0 (VLAN 10)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "vlan": 10, "expected_dscp": "af21", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_CORER1_Gi01", " match vlan 10", "policy-map PM_CORER1_Gi01", " class CM_CORER1_Gi01", "  set dscp af21", "interface GigabitEthernet0/1", " service-policy input PM_CORER1_Gi01", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T15:25:06.282384Z", "interface": "GigabitEthernet0/0", "application": "erp", "expected_dscp": "cs0", "observed_dscp": "af31", "vlan": 30, "description": "QoS misclassification on GigabitEthernet0/0: app=erp, expected DSCP=cs0, observed DSCP=af31 (VLAN 30)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "vlan": 30, "expected_dscp": "cs0", "observed_dscp": "af31"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi00", " match vlan 30", "policy-map PM_BRANCH_Gi00", " class CM_BRANCH_Gi00", "  set dscp cs0", "interface GigabitEthernet0/0", " service-policy input PM_BRANCH_Gi00", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T14:49:06.281450Z", "routing_process": "isis", "pid": 3354, "stuck_minutes": 36, "symptom": "BGP scanner unresponsive", "description": "Routing process 'isis' appears hung (pid=3354), stuck for ~36 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "routing_process": "isis", "pid": 3354, "stuck_minutes": 36}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T15:57:06.280950Z", "routing_process": "bgp", "pid": 176, "stuck_minutes": 14, "symptom": "BGP scanner unresponsive", "description": "Routing process 'bgp' appears hung (pid=176), stuck for ~14 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "routing_process": "bgp", "pid": 176, "stuck_minutes": 14}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T17:26:06.283093Z", "interface": "TenGigabitEthernet1/1", "application": "erp", "expected_dscp": "af31", "observed_dscp": "ef", "vlan": 50, "description": "QoS misclassification on TenGigabitEthernet1/1: app=erp, expected DSCP=af31, observed DSCP=ef (VLAN 50)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "vlan": 50, "expected_dscp": "af31", "observed_dscp": "ef"}], "cli_fix": ["class-map match-any CM_EDGERT_TenGi11", " match vlan 50", "policy-map PM_EDGERT_TenGi11", " class CM_EDGERT_TenGi11", "  set dscp af31", "interface TenGigabitEthernet1/1", " service-policy input PM_EDGERT_TenGi11", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T12:26:06.283472Z", "interface": "TenGigabitEthernet1/2", "application": "backup", "expected_dscp": "af41", "observed_dscp": "cs0", "vlan": 40, "description": "QoS misclassification on TenGigabitEthernet1/2: app=backup, expected DSCP=af41, observed DSCP=cs0 (VLAN 40)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/2", "vlan": 40, "expected_dscp": "af41", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_CORER1_TenGi12", " match vlan 40", "policy-map PM_CORER1_TenGi12", " class CM_CORER1_TenGi12", "  set dscp af41", "interface TenGigabitEthernet1/2", " service-policy input PM_CORER1_TenGi12", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T15:01:06.280262Z", "routing_process": "isis", "pid": 2221, "stuck_minutes": 15, "symptom": "Adjacency state not progressing", "description": "Routing process 'isis' appears hung (pid=2221), stuck for ~15 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "routing_process": "isis", "pid": 2221, "stuck_minutes": 15}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T21:09:06.281599Z", "routing_process": "bgp", "pid": 4900, "stuck_minutes": 23, "symptom": "SPF calculation stuck", "description": "Routing process 'bgp' appears hung (pid=4900), stuck for ~23 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "routing_process": "bgp", "pid": 4900, "stuck_minutes": 23}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T13:33:06.287738Z", "interface": "TenGigabitEthernet1/1", "class": "VOICE", "drop_rate_pct": 28, "current_rate_kbps": 10000, "suggested_rate_kbps": 20000, "reason": "token bucket depleted", "description": "Policing drops on TenGigabitEthernet1/1 class=VOICE. Current rate 10000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "class": "VOICE", "current_rate_kbps": 10000, "suggested_rate_kbps": 20000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 20000 32000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T19:19:06.279789Z", "routing_process": "bgp", "pid": 487, "stuck_minutes": 27, "symptom": "Adjacency state not progressing", "description": "Routing process 'bgp' appears hung (pid=487), stuck for ~27 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "routing_process": "bgp", "pid": 487, "stuck_minutes": 27}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T19:20:06.284170Z", "interface": "GigabitEthernet0/1", "application": "erp", "expected_dscp": "cs3", "observed_dscp": "af21", "vlan": 10, "description": "QoS misclassification on GigabitEthernet0/1: app=erp, expected DSCP=cs3, observed DSCP=af21 (VLAN 10)."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "vlan": 10, "expected_dscp": "cs3", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_DCR2_Gi01", " match vlan 10", "policy-map PM_DCR2_Gi01", " class CM_DCR2_Gi01", "  set dscp cs3", "interface GigabitEthernet0/1", " service-policy input PM_DCR2_Gi01", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T19:11:06.280509Z", "routing_process": "isis", "pid": 1473, "stuck_minutes": 21, "symptom": "RIB update stalled", "description": "Routing process 'isis' appears hung (pid=1473), stuck for ~21 minutes. Symptom: RIB update stalled."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "routing_process": "isis", "pid": 1473, "stuck_minutes": 21}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T14:10:06.284199Z", "interface": "TenGigabitEthernet1/2", "application": "web", "expected_dscp": "cs3", "observed_dscp": "af21", "vlan": 50, "description": "QoS misclassification on TenGigabitEthernet1/2: app=web, expected DSCP=cs3, observed DSCP=af21 (VLAN 50)."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "vlan": 50, "expected_dscp": "cs3", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_DCR2_TenGi12", " match vlan 50", "policy-map PM_DCR2_TenGi12", " class CM_DCR2_TenGi12", "  set dscp cs3", "interface TenGigabitEthernet1/2", " service-policy input PM_DCR2_TenGi12", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T20:09:06.283822Z", "interface": "GigabitEthernet1/0", "application": "voice", "expected_dscp": "af21", "observed_dscp": "af41", "vlan": 50, "description": "QoS misclassification on GigabitEthernet1/0: app=voice, expected DSCP=af21, observed DSCP=af41 (VLAN 50)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "vlan": 50, "expected_dscp": "af21", "observed_dscp": "af41"}], "cli_fix": ["class-map match-any CM_EDGERT_Gi10", " match vlan 50", "policy-map PM_EDGERT_Gi10", " class CM_EDGERT_Gi10", "  set dscp af21", "interface GigabitEthernet1/0", " service-policy input PM_EDGERT_Gi10", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T14:45:06.280456Z", "routing_process": "eigrp", "pid": 3247, "stuck_minutes": 21, "symptom": "BGP scanner unresponsive", "description": "Routing process 'eigrp' appears hung (pid=3247), stuck for ~21 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "routing_process": "eigrp", "pid": 3247, "stuck_minutes": 21}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T16:18:06.279832Z", "routing_process": "bgp", "pid": 1573, "stuck_minutes": 20, "symptom": "BGP scanner unresponsive", "description": "Routing process 'bgp' appears hung (pid=1573), stuck for ~20 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios", "routing_process": "bgp", "pid": 1573, "stuck_minutes": 20}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T16:58:06.284162Z", "interface": "TenGigabitEthernet1/1", "application": "voice", "expected_dscp": "af21", "observed_dscp": "af31", "vlan": 30, "description": "QoS misclassification on TenGigabitEthernet1/1: app=voice, expected DSCP=af21, observed DSCP=af31 (VLAN 30)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "vlan": 30, "expected_dscp": "af21", "observed_dscp": "af31"}], "cli_fix": ["class-map match-any CM_CORER2_TenGi11", " match vlan 30", "policy-map PM_CORER2_TenGi11", " class CM_CORER2_TenGi11", "  set dscp af21", "interface TenGigabitEthernet1/1", " service-policy input PM_CORER2_TenGi11", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T14:47:06.286934Z", "interface": "GigabitEthernet0/1", "class": "BULK", "drop_rate_pct": 21, "current_rate_kbps": 20000, "suggested_rate_kbps": 40000, "reason": "burst too small", "description": "Policing drops on GigabitEthernet0/1 class=BULK. Current rate 20000 kbps; drops due to burst too small."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "class": "BULK", "current_rate_kbps": 20000, "suggested_rate_kbps": 40000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 40000 16000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T19:24:06.280842Z", "routing_process": "ospf", "pid": 1782, "stuck_minutes": 5, "symptom": "SPF calculation stuck", "description": "Routing process 'ospf' appears hung (pid=1782), stuck for ~5 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "routing_process": "ospf", "pid": 1782, "stuck_minutes": 5}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T15:18:06.286158Z", "interface": "TenGigabitEthernet1/1", "class": "BULK", "drop_rate_pct": 5, "current_rate_kbps": 5000, "suggested_rate_kbps": 10000, "reason": "policer exceed drops", "description": "Policing drops on TenGigabitEthernet1/1 class=BULK. Current rate 5000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "class": "BULK", "current_rate_kbps": 5000, "suggested_rate_kbps": 10000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 10000 32000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T14:02:06.284371Z", "interface": "GigabitEthernet0/1", "application": "backup", "expected_dscp": "cs0", "observed_dscp": "cs3", "vlan": 50, "description": "QoS misclassification on GigabitEthernet0/1: app=backup, expected DSCP=cs0, observed DSCP=cs3 (VLAN 50)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "vlan": 50, "expected_dscp": "cs0", "observed_dscp": "cs3"}], "cli_fix": ["class-map match-any CM_CORER1_Gi01", " match vlan 50", "policy-map PM_CORER1_Gi01", " class CM_CORER1_Gi01", "  set dscp cs0", "interface GigabitEthernet0/1", " service-policy input PM_CORER1_Gi01", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T15:12:06.282555Z", "interface": "GigabitEthernet0/1", "application": "erp", "expected_dscp": "cs0", "observed_dscp": "af31", "vlan": 20, "description": "QoS misclassification on GigabitEthernet0/1: app=erp, expected DSCP=cs0, observed DSCP=af31 (VLAN 20)."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "vlan": 20, "expected_dscp": "cs0", "observed_dscp": "af31"}], "cli_fix": ["class-map match-any CM_DCR1_Gi01", " match vlan 20", "policy-map PM_DCR1_Gi01", " class CM_DCR1_Gi01", "  set dscp cs0", "interface GigabitEthernet0/1", " service-policy input PM_DCR1_Gi01", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T14:59:06.288022Z", "interface": "GigabitEthernet0/0", "class": "VOICE", "drop_rate_pct": 38, "current_rate_kbps": 5000, "suggested_rate_kbps": 10000, "reason": "burst too small", "description": "Policing drops on GigabitEthernet0/0 class=VOICE. Current rate 5000 kbps; drops due to burst too small."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "class": "VOICE", "current_rate_kbps": 5000, "suggested_rate_kbps": 10000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 10000 64000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/0", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T12:34:06.287570Z", "interface": "GigabitEthernet1/0", "class": "VOICE", "drop_rate_pct": 28, "current_rate_kbps": 10000, "suggested_rate_kbps": 30000, "reason": "policer exceed drops", "description": "Policing drops on GigabitEthernet1/0 class=VOICE. Current rate 10000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "class": "VOICE", "current_rate_kbps": 10000, "suggested_rate_kbps": 30000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 30000 8000 conform-action transmit exceed-action drop", "interface GigabitEthernet1/0", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T20:58:06.285685Z", "interface": "GigabitEthernet0/1", "class": "VOICE", "drop_rate_pct": 40, "current_rate_kbps": 10000, "suggested_rate_kbps": 20000, "reason": "policer exceed drops", "description": "Policing drops on GigabitEthernet0/1 class=VOICE. Current rate 10000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "class": "VOICE", "current_rate_kbps": 10000, "suggested_rate_kbps": 20000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 20000 64000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T21:29:06.286378Z", "interface": "GigabitEthernet0/0", "class": "DATA", "drop_rate_pct": 7, "current_rate_kbps": 1000, "suggested_rate_kbps": 3000, "reason": "rate too low", "description": "Policing drops on GigabitEthernet0/0 class=DATA. Current rate 1000 kbps; drops due to rate too low."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "class": "DATA", "current_rate_kbps": 1000, "suggested_rate_kbps": 3000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 3000 64000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/0", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T14:38:06.283688Z", "interface": "TenGigabitEthernet1/1", "application": "voice", "expected_dscp": "af21", "observed_dscp": "ef", "vlan": 40, "description": "QoS misclassification on TenGigabitEthernet1/1: app=voice, expected DSCP=af21, observed DSCP=ef (VLAN 40)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "vlan": 40, "expected_dscp": "af21", "observed_dscp": "ef"}], "cli_fix": ["class-map match-any CM_EDGERT_TenGi11", " match vlan 40", "policy-map PM_EDGERT_TenGi11", " class CM_EDGERT_TenGi11", "  set dscp af21", "interface TenGigabitEthernet1/1", " service-policy input PM_EDGERT_TenGi11", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T19:18:06.283219Z", "interface": "GigabitEthernet1/0", "application": "backup", "expected_dscp": "af31", "observed_dscp": "cs3", "vlan": 40, "description": "QoS misclassification on GigabitEthernet1/0: app=backup, expected DSCP=af31, observed DSCP=cs3 (VLAN 40)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "vlan": 40, "expected_dscp": "af31", "observed_dscp": "cs3"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi10", " match vlan 40", "policy-map PM_BRANCH_Gi10", " class CM_BRANCH_Gi10", "  set dscp af31", "interface GigabitEthernet1/0", " service-policy input PM_BRANCH_Gi10", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T13:26:06.286449Z", "interface": "TenGigabitEthernet1/1", "class": "VIDEO", "drop_rate_pct": 28, "current_rate_kbps": 2000, "suggested_rate_kbps": 4000, "reason": "token bucket depleted", "description": "Policing drops on TenGigabitEthernet1/1 class=VIDEO. Current rate 2000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "class": "VIDEO", "current_rate_kbps": 2000, "suggested_rate_kbps": 4000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 4000 32000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T20:40:06.280541Z", "routing_process": "bgp", "pid": 2873, "stuck_minutes": 4, "symptom": "BGP scanner unresponsive", "description": "Routing process 'bgp' appears hung (pid=2873), stuck for ~4 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios_xe", "routing_process": "bgp", "pid": 2873, "stuck_minutes": 4}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T15:13:06.283829Z", "interface": "GigabitEthernet0/1", "application": "web", "expected_dscp": "cs3", "observed_dscp": "af31", "vlan": 20, "description": "QoS misclassification on GigabitEthernet0/1: app=web, expected DSCP=cs3, observed DSCP=af31 (VLAN 20)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "vlan": 20, "expected_dscp": "cs3", "observed_dscp": "af31"}], "cli_fix": ["class-map match-any CM_EDGERT_Gi01", " match vlan 20", "policy-map PM_EDGERT_Gi01", " class CM_EDGERT_Gi01", "  set dscp cs3", "interface GigabitEthernet0/1", " service-policy input PM_EDGERT_Gi01", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T16:17:06.288282Z", "interface": "GigabitEthernet0/0", "class": "BULK", "drop_rate_pct": 20, "current_rate_kbps": 10000, "suggested_rate_kbps": 30000, "reason": "policer exceed drops", "description": "Policing drops on GigabitEthernet0/0 class=BULK. Current rate 10000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "class": "BULK", "current_rate_kbps": 10000, "suggested_rate_kbps": 30000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 30000 16000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/0", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T19:43:06.281901Z", "interface": "GigabitEthernet0/1", "application": "web", "expected_dscp": "cs3", "observed_dscp": "cs0", "vlan": 50, "description": "QoS misclassification on GigabitEthernet0/1: app=web, expected DSCP=cs3, observed DSCP=cs0 (VLAN 50)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "vlan": 50, "expected_dscp": "cs3", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi01", " match vlan 50", "policy-map PM_BRANCH_Gi01", " class CM_BRANCH_Gi01", "  set dscp cs3", "interface GigabitEthernet0/1", " service-policy input PM_BRANCH_Gi01", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T12:39:06.282286Z", "interface": "TenGigabitEthernet1/1", "application": "erp", "expected_dscp": "af31", "observed_dscp": "ef", "vlan": 50, "description": "QoS misclassification on TenGigabitEthernet1/1: app=erp, expected DSCP=af31, observed DSCP=ef (VLAN 50)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "vlan": 50, "expected_dscp": "af31", "observed_dscp": "ef"}], "cli_fix": ["class-map match-any CM_BRANCH_TenGi11", " match vlan 50", "policy-map PM_BRANCH_TenGi11", " class CM_BRANCH_TenGi11", "  set dscp af31", "interface TenGigabitEthernet1/1", " service-policy input PM_BRANCH_TenGi11", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T19:51:06.282823Z", "interface": "GigabitEthernet0/0", "application": "backup", "expected_dscp": "cs0", "observed_dscp": "cs3", "vlan": 50, "description": "QoS misclassification on GigabitEthernet0/0: app=backup, expected DSCP=cs0, observed DSCP=cs3 (VLAN 50)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "vlan": 50, "expected_dscp": "cs0", "observed_dscp": "cs3"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi00", " match vlan 50", "policy-map PM_BRANCH_Gi00", " class CM_BRANCH_Gi00", "  set dscp cs0", "interface GigabitEthernet0/0", " service-policy input PM_BRANCH_Gi00", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T17:10:06.284780Z", "interface": "TenGigabitEthernet1/2", "application": "web", "expected_dscp": "af41", "observed_dscp": "af21", "vlan": 40, "description": "QoS misclassification on TenGigabitEthernet1/2: app=web, expected DSCP=af41, observed DSCP=af21 (VLAN 40)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/2", "vlan": 40, "expected_dscp": "af41", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_EDGERT_TenGi12", " match vlan 40", "policy-map PM_EDGERT_TenGi12", " class CM_EDGERT_TenGi12", "  set dscp af41", "interface TenGigabitEthernet1/2", " service-policy input PM_EDGERT_TenGi12", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T12:10:06.284300Z", "interface": "GigabitEthernet0/0", "application": "web", "expected_dscp": "af41", "observed_dscp": "cs0", "vlan": 50, "description": "QoS misclassification on GigabitEthernet0/0: app=web, expected DSCP=af41, observed DSCP=cs0 (VLAN 50)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "vlan": 50, "expected_dscp": "af41", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_EDGERT_Gi00", " match vlan 50", "policy-map PM_EDGERT_Gi00", " class CM_EDGERT_Gi00", "  set dscp af41", "interface GigabitEthernet0/0", " service-policy input PM_EDGERT_Gi00", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T13:26:06.285807Z", "interface": "TenGigabitEthernet1/1", "class": "DATA", "drop_rate_pct": 38, "current_rate_kbps": 10000, "suggested_rate_kbps": 30000, "reason": "rate too low", "description": "Policing drops on TenGigabitEthernet1/1 class=DATA. Current rate 10000 kbps; drops due to rate too low."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "class": "DATA", "current_rate_kbps": 10000, "suggested_rate_kbps": 30000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 30000 64000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T19:32:06.287768Z", "interface": "GigabitEthernet0/1", "class": "VOICE", "drop_rate_pct": 21, "current_rate_kbps": 2000, "suggested_rate_kbps": 4000, "reason": "burst too small", "description": "Policing drops on GigabitEthernet0/1 class=VOICE. Current rate 2000 kbps; drops due to burst too small."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "class": "VOICE", "current_rate_kbps": 2000, "suggested_rate_kbps": 4000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 4000 32000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T17:21:06.283066Z", "interface": "GigabitEthernet1/0", "application": "voice", "expected_dscp": "af21", "observed_dscp": "af31", "vlan": 30, "description": "QoS misclassification on GigabitEthernet1/0: app=voice, expected DSCP=af21, observed DSCP=af31 (VLAN 30)."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "vlan": 30, "expected_dscp": "af21", "observed_dscp": "af31"}], "cli_fix": ["class-map match-any CM_DCR2_Gi10", " match vlan 30", "policy-map PM_DCR2_Gi10", " class CM_DCR2_Gi10", "  set dscp af21", "interface GigabitEthernet1/0", " service-policy input PM_DCR2_Gi10", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T12:37:06.280065Z", "routing_process": "isis", "pid": 3796, "stuck_minutes": 3, "symptom": "Adjacency state not progressing", "description": "Routing process 'isis' appears hung (pid=3796), stuck for ~3 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "routing_process": "isis", "pid": 3796, "stuck_minutes": 3}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:20:06.283025Z", "interface": "TenGigabitEthernet1/1", "application": "erp", "expected_dscp": "cs0", "observed_dscp": "af41", "vlan": 10, "description": "QoS misclassification on TenGigabitEthernet1/1: app=erp, expected DSCP=cs0, observed DSCP=af41 (VLAN 10)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "vlan": 10, "expected_dscp": "cs0", "observed_dscp": "af41"}], "cli_fix": ["class-map match-any CM_CORER1_TenGi11", " match vlan 10", "policy-map PM_CORER1_TenGi11", " class CM_CORER1_TenGi11", "  set dscp cs0", "interface TenGigabitEthernet1/1", " service-policy input PM_CORER1_TenGi11", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T20:07:06.283108Z", "interface": "GigabitEthernet1/0", "application": "video", "expected_dscp": "cs0", "observed_dscp": "af21", "vlan": 30, "description": "QoS misclassification on GigabitEthernet1/0: app=video, expected DSCP=cs0, observed DSCP=af21 (VLAN 30)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "vlan": 30, "expected_dscp": "cs0", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_EDGERT_Gi10", " match vlan 30", "policy-map PM_EDGERT_Gi10", " class CM_EDGERT_Gi10", "  set dscp cs0", "interface GigabitEthernet1/0", " service-policy input PM_EDGERT_Gi10", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T14:14:06.287186Z", "interface": "GigabitEthernet0/1", "class": "BULK", "drop_rate_pct": 28, "current_rate_kbps": 2000, "suggested_rate_kbps": 6000, "reason": "token bucket depleted", "description": "Policing drops on GigabitEthernet0/1 class=BULK. Current rate 2000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "class": "BULK", "current_rate_kbps": 2000, "suggested_rate_kbps": 6000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 6000 64000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T12:22:06.287007Z", "interface": "GigabitEthernet1/0", "class": "BULK", "drop_rate_pct": 9, "current_rate_kbps": 10000, "suggested_rate_kbps": 20000, "reason": "policer exceed drops", "description": "Policing drops on GigabitEthernet1/0 class=BULK. Current rate 10000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "class": "BULK", "current_rate_kbps": 10000, "suggested_rate_kbps": 20000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 20000 8000 conform-action transmit exceed-action drop", "interface GigabitEthernet1/0", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T14:01:06.280099Z", "routing_process": "bgp", "pid": 2950, "stuck_minutes": 19, "symptom": "SPF calculation stuck", "description": "Routing process 'bgp' appears hung (pid=2950), stuck for ~19 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "routing_process": "bgp", "pid": 2950, "stuck_minutes": 19}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T12:40:06.280412Z", "routing_process": "eigrp", "pid": 4274, "stuck_minutes": 44, "symptom": "SPF calculation stuck", "description": "Routing process 'eigrp' appears hung (pid=4274), stuck for ~44 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "routing_process": "eigrp", "pid": 4274, "stuck_minutes": 44}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T15:25:06.282924Z", "interface": "TenGigabitEthernet1/1", "application": "erp", "expected_dscp": "af21", "observed_dscp": "af41", "vlan": 50, "description": "QoS misclassification on TenGigabitEthernet1/1: app=erp, expected DSCP=af21, observed DSCP=af41 (VLAN 50)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "vlan": 50, "expected_dscp": "af21", "observed_dscp": "af41"}], "cli_fix": ["class-map match-any CM_EDGERT_TenGi11", " match vlan 50", "policy-map PM_EDGERT_TenGi11", " class CM_EDGERT_TenGi11", "  set dscp af21", "interface TenGigabitEthernet1/1", " service-policy input PM_EDGERT_TenGi11", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T15:45:06.284411Z", "interface": "TenGigabitEthernet1/1", "application": "voice", "expected_dscp": "af41", "observed_dscp": "af21", "vlan": 50, "description": "QoS misclassification on TenGigabitEthernet1/1: app=voice, expected DSCP=af41, observed DSCP=af21 (VLAN 50)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "vlan": 50, "expected_dscp": "af41", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_BRANCH_TenGi11", " match vlan 50", "policy-map PM_BRANCH_TenGi11", " class CM_BRANCH_TenGi11", "  set dscp af41", "interface TenGigabitEthernet1/1", " service-policy input PM_BRANCH_TenGi11", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T18:30:06.280604Z", "routing_process": "bgp", "pid": 1654, "stuck_minutes": 13, "symptom": "Adjacency state not progressing", "description": "Routing process 'bgp' appears hung (pid=1654), stuck for ~13 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "routing_process": "bgp", "pid": 1654, "stuck_minutes": 13}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T11:57:06.279587Z", "routing_process": "bgp", "pid": 4724, "stuck_minutes": 9, "symptom": "SPF calculation stuck", "description": "Routing process 'bgp' appears hung (pid=4724), stuck for ~9 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "routing_process": "bgp", "pid": 4724, "stuck_minutes": 9}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T12:50:06.287298Z", "interface": "GigabitEthernet0/0", "class": "DATA", "drop_rate_pct": 20, "current_rate_kbps": 10000, "suggested_rate_kbps": 20000, "reason": "token bucket depleted", "description": "Policing drops on GigabitEthernet0/0 class=DATA. Current rate 10000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "class": "DATA", "current_rate_kbps": 10000, "suggested_rate_kbps": 20000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 20000 16000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/0", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T19:44:06.286619Z", "interface": "GigabitEthernet0/0", "class": "BULK", "drop_rate_pct": 36, "current_rate_kbps": 10000, "suggested_rate_kbps": 20000, "reason": "token bucket depleted", "description": "Policing drops on GigabitEthernet0/0 class=BULK. Current rate 10000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "class": "BULK", "current_rate_kbps": 10000, "suggested_rate_kbps": 20000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 20000 16000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/0", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T14:46:06.280925Z", "routing_process": "eigrp", "pid": 4889, "stuck_minutes": 34, "symptom": "RIB update stalled", "description": "Routing process 'eigrp' appears hung (pid=4889), stuck for ~34 minutes. Symptom: RIB update stalled."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "routing_process": "eigrp", "pid": 4889, "stuck_minutes": 34}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T19:19:06.285079Z", "interface": "GigabitEthernet1/0", "application": "backup", "expected_dscp": "af31", "observed_dscp": "cs0", "vlan": 10, "description": "QoS misclassification on GigabitEthernet1/0: app=backup, expected DSCP=af31, observed DSCP=cs0 (VLAN 10)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "vlan": 10, "expected_dscp": "af31", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_EDGERT_Gi10", " match vlan 10", "policy-map PM_EDGERT_Gi10", " class CM_EDGERT_Gi10", "  set dscp af31", "interface GigabitEthernet1/0", " service-policy input PM_EDGERT_Gi10", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T17:40:06.281493Z", "routing_process": "bgp", "pid": 1117, "stuck_minutes": 31, "symptom": "SPF calculation stuck", "description": "Routing process 'bgp' appears hung (pid=1117), stuck for ~31 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "routing_process": "bgp", "pid": 1117, "stuck_minutes": 31}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T13:05:06.287731Z", "interface": "TenGigabitEthernet1/1", "class": "VIDEO", "drop_rate_pct": 37, "current_rate_kbps": 20000, "suggested_rate_kbps": 40000, "reason": "token bucket depleted", "description": "Policing drops on TenGigabitEthernet1/1 class=VIDEO. Current rate 20000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "class": "VIDEO", "current_rate_kbps": 20000, "suggested_rate_kbps": 40000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 40000 64000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T17:15:06.286595Z", "interface": "GigabitEthernet1/0", "class": "VOICE", "drop_rate_pct": 25, "current_rate_kbps": 10000, "suggested_rate_kbps": 20000, "reason": "token bucket depleted", "description": "Policing drops on GigabitEthernet1/0 class=VOICE. Current rate 10000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "class": "VOICE", "current_rate_kbps": 10000, "suggested_rate_kbps": 20000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 20000 8000 conform-action transmit exceed-action drop", "interface GigabitEthernet1/0", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T17:19:06.281623Z", "routing_process": "ospf", "pid": 3633, "stuck_minutes": 32, "symptom": "BGP scanner unresponsive", "description": "Routing process 'ospf' appears hung (pid=3633), stuck for ~32 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "routing_process": "ospf", "pid": 3633, "stuck_minutes": 32}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T20:23:06.280988Z", "routing_process": "eigrp", "pid": 1482, "stuck_minutes": 28, "symptom": "SPF calculation stuck", "description": "Routing process 'eigrp' appears hung (pid=1482), stuck for ~28 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "routing_process": "eigrp", "pid": 1482, "stuck_minutes": 28}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T17:11:06.283127Z", "interface": "GigabitEthernet0/1", "application": "backup", "expected_dscp": "cs3", "observed_dscp": "af41", "vlan": 20, "description": "QoS misclassification on GigabitEthernet0/1: app=backup, expected DSCP=cs3, observed DSCP=af41 (VLAN 20)."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "vlan": 20, "expected_dscp": "cs3", "observed_dscp": "af41"}], "cli_fix": ["class-map match-any CM_DCR1_Gi01", " match vlan 20", "policy-map PM_DCR1_Gi01", " class CM_DCR1_Gi01", "  set dscp cs3", "interface GigabitEthernet0/1", " service-policy input PM_DCR1_Gi01", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T20:14:06.286818Z", "interface": "TenGigabitEthernet1/1", "class": "VIDEO", "drop_rate_pct": 7, "current_rate_kbps": 2000, "suggested_rate_kbps": 4000, "reason": "policer exceed drops", "description": "Policing drops on TenGigabitEthernet1/1 class=VIDEO. Current rate 2000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "class": "VIDEO", "current_rate_kbps": 2000, "suggested_rate_kbps": 4000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 4000 32000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T18:29:06.283506Z", "interface": "TenGigabitEthernet1/1", "application": "video", "expected_dscp": "cs3", "observed_dscp": "cs0", "vlan": 30, "description": "QoS misclassification on TenGigabitEthernet1/1: app=video, expected DSCP=cs3, observed DSCP=cs0 (VLAN 30)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "vlan": 30, "expected_dscp": "cs3", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_BRANCH_TenGi11", " match vlan 30", "policy-map PM_BRANCH_TenGi11", " class CM_BRANCH_TenGi11", "  set dscp cs3", "interface TenGigabitEthernet1/1", " service-policy input PM_BRANCH_TenGi11", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T18:41:06.282253Z", "interface": "GigabitEthernet0/1", "application": "video", "expected_dscp": "af41", "observed_dscp": "af31", "vlan": 30, "description": "QoS misclassification on GigabitEthernet0/1: app=video, expected DSCP=af41, observed DSCP=af31 (VLAN 30)."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "vlan": 30, "expected_dscp": "af41", "observed_dscp": "af31"}], "cli_fix": ["class-map match-any CM_DCR1_Gi01", " match vlan 30", "policy-map PM_DCR1_Gi01", " class CM_DCR1_Gi01", "  set dscp af41", "interface GigabitEthernet0/1", " service-policy input PM_DCR1_Gi01", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T21:25:06.287322Z", "interface": "TenGigabitEthernet1/2", "class": "VIDEO", "drop_rate_pct": 17, "current_rate_kbps": 10000, "suggested_rate_kbps": 20000, "reason": "token bucket depleted", "description": "Policing drops on TenGigabitEthernet1/2 class=VIDEO. Current rate 10000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "class": "VIDEO", "current_rate_kbps": 10000, "suggested_rate_kbps": 20000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 20000 16000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T20:52:06.286849Z", "interface": "GigabitEthernet1/0", "class": "VOICE", "drop_rate_pct": 23, "current_rate_kbps": 2000, "suggested_rate_kbps": 6000, "reason": "policer exceed drops", "description": "Policing drops on GigabitEthernet1/0 class=VOICE. Current rate 2000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "class": "VOICE", "current_rate_kbps": 2000, "suggested_rate_kbps": 6000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 6000 8000 conform-action transmit exceed-action drop", "interface GigabitEthernet1/0", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T20:38:06.286431Z", "interface": "GigabitEthernet0/1", "class": "DATA", "drop_rate_pct": 35, "current_rate_kbps": 1000, "suggested_rate_kbps": 3000, "reason": "policer exceed drops", "description": "Policing drops on GigabitEthernet0/1 class=DATA. Current rate 1000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "class": "DATA", "current_rate_kbps": 1000, "suggested_rate_kbps": 3000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 3000 16000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T21:30:06.281456Z", "routing_process": "bgp", "pid": 169, "stuck_minutes": 44, "symptom": "Routing table not updating", "description": "Routing process 'bgp' appears hung (pid=169), stuck for ~44 minutes. Symptom: Routing table not updating."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "routing_process": "bgp", "pid": 169, "stuck_minutes": 44}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T12:31:06.280765Z", "routing_process": "eigrp", "pid": 3332, "stuck_minutes": 4, "symptom": "BGP scanner unresponsive", "description": "Routing process 'eigrp' appears hung (pid=3332), stuck for ~4 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "routing_process": "eigrp", "pid": 3332, "stuck_minutes": 4}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T13:54:06.280147Z", "routing_process": "eigrp", "pid": 2343, "stuck_minutes": 22, "symptom": "Adjacency state not progressing", "description": "Routing process 'eigrp' appears hung (pid=2343), stuck for ~22 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "routing_process": "eigrp", "pid": 2343, "stuck_minutes": 22}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T20:23:06.281058Z", "routing_process": "eigrp", "pid": 3158, "stuck_minutes": 17, "symptom": "RIB update stalled", "description": "Routing process 'eigrp' appears hung (pid=3158), stuck for ~17 minutes. Symptom: RIB update stalled."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "routing_process": "eigrp", "pid": 3158, "stuck_minutes": 17}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T13:50:06.279805Z", "routing_process": "bgp", "pid": 3590, "stuck_minutes": 11, "symptom": "SPF calculation stuck", "description": "Routing process 'bgp' appears hung (pid=3590), stuck for ~11 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios_xe", "routing_process": "bgp", "pid": 3590, "stuck_minutes": 11}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:37:06.283925Z", "interface": "GigabitEthernet0/1", "application": "video", "expected_dscp": "af41", "observed_dscp": "ef", "vlan": 40, "description": "QoS misclassification on GigabitEthernet0/1: app=video, expected DSCP=af41, observed DSCP=ef (VLAN 40)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "vlan": 40, "expected_dscp": "af41", "observed_dscp": "ef"}], "cli_fix": ["class-map match-any CM_EDGERT_Gi01", " match vlan 40", "policy-map PM_EDGERT_Gi01", " class CM_EDGERT_Gi01", "  set dscp af41", "interface GigabitEthernet0/1", " service-policy input PM_EDGERT_Gi01", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T13:38:06.280956Z", "routing_process": "ospf", "pid": 3036, "stuck_minutes": 23, "symptom": "Adjacency state not progressing", "description": "Routing process 'ospf' appears hung (pid=3036), stuck for ~23 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "routing_process": "ospf", "pid": 3036, "stuck_minutes": 23}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T17:02:06.288214Z", "interface": "TenGigabitEthernet1/1", "class": "BULK", "drop_rate_pct": 32, "current_rate_kbps": 20000, "suggested_rate_kbps": 60000, "reason": "token bucket depleted", "description": "Policing drops on TenGigabitEthernet1/1 class=BULK. Current rate 20000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "class": "BULK", "current_rate_kbps": 20000, "suggested_rate_kbps": 60000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 60000 64000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:27:06.284885Z", "interface": "GigabitEthernet0/1", "application": "voice", "expected_dscp": "ef", "observed_dscp": "cs0", "vlan": 50, "description": "QoS misclassification on GigabitEthernet0/1: app=voice, expected DSCP=ef, observed DSCP=cs0 (VLAN 50)."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "vlan": 50, "expected_dscp": "ef", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_DCR2_Gi01", " match vlan 50", "policy-map PM_DCR2_Gi01", " class CM_DCR2_Gi01", "  set dscp ef", "interface GigabitEthernet0/1", " service-policy input PM_DCR2_Gi01", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T13:09:06.283950Z", "interface": "TenGigabitEthernet1/1", "application": "backup", "expected_dscp": "af31", "observed_dscp": "af21", "vlan": 30, "description": "QoS misclassification on TenGigabitEthernet1/1: app=backup, expected DSCP=af31, observed DSCP=af21 (VLAN 30)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "vlan": 30, "expected_dscp": "af31", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_CORER1_TenGi11", " match vlan 30", "policy-map PM_CORER1_TenGi11", " class CM_CORER1_TenGi11", "  set dscp af31", "interface TenGigabitEthernet1/1", " service-policy input PM_CORER1_TenGi11", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T17:51:06.282638Z", "interface": "TenGigabitEthernet1/1", "application": "backup", "expected_dscp": "af41", "observed_dscp": "cs0", "vlan": 30, "description": "QoS misclassification on TenGigabitEthernet1/1: app=backup, expected DSCP=af41, observed DSCP=cs0 (VLAN 30)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "vlan": 30, "expected_dscp": "af41", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_EDGERT_TenGi11", " match vlan 30", "policy-map PM_EDGERT_TenGi11", " class CM_EDGERT_TenGi11", "  set dscp af41", "interface TenGigabitEthernet1/1", " service-policy input PM_EDGERT_TenGi11", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T17:01:06.284503Z", "interface": "GigabitEthernet0/0", "application": "erp", "expected_dscp": "af21", "observed_dscp": "cs0", "vlan": 10, "description": "QoS misclassification on GigabitEthernet0/0: app=erp, expected DSCP=af21, observed DSCP=cs0 (VLAN 10)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "vlan": 10, "expected_dscp": "af21", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi00", " match vlan 10", "policy-map PM_BRANCH_Gi00", " class CM_BRANCH_Gi00", "  set dscp af21", "interface GigabitEthernet0/0", " service-policy input PM_BRANCH_Gi00", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T15:24:06.279989Z", "routing_process": "bgp", "pid": 485, "stuck_minutes": 11, "symptom": "Adjacency state not progressing", "description": "Routing process 'bgp' appears hung (pid=485), stuck for ~11 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "routing_process": "bgp", "pid": 485, "stuck_minutes": 11}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T19:08:06.286785Z", "interface": "TenGigabitEthernet1/2", "class": "DATA", "drop_rate_pct": 7, "current_rate_kbps": 5000, "suggested_rate_kbps": 10000, "reason": "policer exceed drops", "description": "Policing drops on TenGigabitEthernet1/2 class=DATA. Current rate 5000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/2", "class": "DATA", "current_rate_kbps": 5000, "suggested_rate_kbps": 10000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 10000 16000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T15:44:06.285922Z", "interface": "GigabitEthernet0/1", "class": "VOICE", "drop_rate_pct": 8, "current_rate_kbps": 5000, "suggested_rate_kbps": 15000, "reason": "policer exceed drops", "description": "Policing drops on GigabitEthernet0/1 class=VOICE. Current rate 5000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "class": "VOICE", "current_rate_kbps": 5000, "suggested_rate_kbps": 15000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 15000 64000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T12:50:06.287789Z", "interface": "TenGigabitEthernet1/2", "class": "VIDEO", "drop_rate_pct": 35, "current_rate_kbps": 5000, "suggested_rate_kbps": 15000, "reason": "policer exceed drops", "description": "Policing drops on TenGigabitEthernet1/2 class=VIDEO. Current rate 5000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/2", "class": "VIDEO", "current_rate_kbps": 5000, "suggested_rate_kbps": 15000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 15000 64000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T13:40:06.281506Z", "routing_process": "isis", "pid": 1377, "stuck_minutes": 39, "symptom": "Routing table not updating", "description": "Routing process 'isis' appears hung (pid=1377), stuck for ~39 minutes. Symptom: Routing table not updating."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios", "routing_process": "isis", "pid": 1377, "stuck_minutes": 39}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T17:38:06.287025Z", "interface": "GigabitEthernet1/0", "class": "DATA", "drop_rate_pct": 8, "current_rate_kbps": 2000, "suggested_rate_kbps": 6000, "reason": "burst too small", "description": "Policing drops on GigabitEthernet1/0 class=DATA. Current rate 2000 kbps; drops due to burst too small."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "class": "DATA", "current_rate_kbps": 2000, "suggested_rate_kbps": 6000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 6000 64000 conform-action transmit exceed-action drop", "interface GigabitEthernet1/0", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T19:08:06.279839Z", "routing_process": "bgp", "pid": 1480, "stuck_minutes": 24, "symptom": "Routing table not updating", "description": "Routing process 'bgp' appears hung (pid=1480), stuck for ~24 minutes. Symptom: Routing table not updating."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "routing_process": "bgp", "pid": 1480, "stuck_minutes": 24}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T19:55:06.286864Z", "interface": "TenGigabitEthernet1/1", "class": "VIDEO", "drop_rate_pct": 36, "current_rate_kbps": 2000, "suggested_rate_kbps": 6000, "reason": "burst too small", "description": "Policing drops on TenGigabitEthernet1/1 class=VIDEO. Current rate 2000 kbps; drops due to burst too small."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "class": "VIDEO", "current_rate_kbps": 2000, "suggested_rate_kbps": 6000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 6000 32000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T18:45:06.285540Z", "interface": "GigabitEthernet0/0", "class": "BULK", "drop_rate_pct": 7, "current_rate_kbps": 2000, "suggested_rate_kbps": 4000, "reason": "policer exceed drops", "description": "Policing drops on GigabitEthernet0/0 class=BULK. Current rate 2000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "class": "BULK", "current_rate_kbps": 2000, "suggested_rate_kbps": 4000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 4000 16000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/0", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T19:51:06.282650Z", "interface": "GigabitEthernet0/1", "application": "backup", "expected_dscp": "af41", "observed_dscp": "cs3", "vlan": 10, "description": "QoS misclassification on GigabitEthernet0/1: app=backup, expected DSCP=af41, observed DSCP=cs3 (VLAN 10)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "vlan": 10, "expected_dscp": "af41", "observed_dscp": "cs3"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi01", " match vlan 10", "policy-map PM_BRANCH_Gi01", " class CM_BRANCH_Gi01", "  set dscp af41", "interface GigabitEthernet0/1", " service-policy input PM_BRANCH_Gi01", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T12:21:06.282932Z", "interface": "GigabitEthernet0/1", "application": "backup", "expected_dscp": "cs0", "observed_dscp": "af41", "vlan": 20, "description": "QoS misclassification on GigabitEthernet0/1: app=backup, expected DSCP=cs0, observed DSCP=af41 (VLAN 20)."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "vlan": 20, "expected_dscp": "cs0", "observed_dscp": "af41"}], "cli_fix": ["class-map match-any CM_DCR2_Gi01", " match vlan 20", "policy-map PM_DCR2_Gi01", " class CM_DCR2_Gi01", "  set dscp cs0", "interface GigabitEthernet0/1", " service-policy input PM_DCR2_Gi01", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T13:53:06.287671Z", "interface": "TenGigabitEthernet1/2", "class": "VIDEO", "drop_rate_pct": 13, "current_rate_kbps": 20000, "suggested_rate_kbps": 60000, "reason": "policer exceed drops", "description": "Policing drops on TenGigabitEthernet1/2 class=VIDEO. Current rate 20000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "class": "VIDEO", "current_rate_kbps": 20000, "suggested_rate_kbps": 60000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 60000 32000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T14:56:06.286604Z", "interface": "GigabitEthernet0/1", "class": "VOICE", "drop_rate_pct": 35, "current_rate_kbps": 10000, "suggested_rate_kbps": 20000, "reason": "rate too low", "description": "Policing drops on GigabitEthernet0/1 class=VOICE. Current rate 10000 kbps; drops due to rate too low."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "class": "VOICE", "current_rate_kbps": 10000, "suggested_rate_kbps": 20000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 20000 16000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T18:42:06.287066Z", "interface": "TenGigabitEthernet1/2", "class": "BULK", "drop_rate_pct": 40, "current_rate_kbps": 5000, "suggested_rate_kbps": 15000, "reason": "burst too small", "description": "Policing drops on TenGigabitEthernet1/2 class=BULK. Current rate 5000 kbps; drops due to burst too small."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/2", "class": "BULK", "current_rate_kbps": 5000, "suggested_rate_kbps": 15000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 15000 16000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T14:34:06.281267Z", "routing_process": "eigrp", "pid": 2877, "stuck_minutes": 5, "symptom": "SPF calculation stuck", "description": "Routing process 'eigrp' appears hung (pid=2877), stuck for ~5 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios_xe", "routing_process": "eigrp", "pid": 2877, "stuck_minutes": 5}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T18:44:06.281399Z", "routing_process": "eigrp", "pid": 1724, "stuck_minutes": 22, "symptom": "BGP scanner unresponsive", "description": "Routing process 'eigrp' appears hung (pid=1724), stuck for ~22 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "routing_process": "eigrp", "pid": 1724, "stuck_minutes": 22}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:21:06.281325Z", "routing_process": "ospf", "pid": 1289, "stuck_minutes": 7, "symptom": "RIB update stalled", "description": "Routing process 'ospf' appears hung (pid=1289), stuck for ~7 minutes. Symptom: RIB update stalled."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios_xe", "routing_process": "ospf", "pid": 1289, "stuck_minutes": 7}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T15:24:06.284913Z", "interface": "TenGigabitEthernet1/2", "application": "backup", "expected_dscp": "ef", "observed_dscp": "af31", "vlan": 20, "description": "QoS misclassification on TenGigabitEthernet1/2: app=backup, expected DSCP=ef, observed DSCP=af31 (VLAN 20)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "vlan": 20, "expected_dscp": "ef", "observed_dscp": "af31"}], "cli_fix": ["class-map match-any CM_EDGERT_TenGi12", " match vlan 20", "policy-map PM_EDGERT_TenGi12", " class CM_EDGERT_TenGi12", "  set dscp ef", "interface TenGigabitEthernet1/2", " service-policy input PM_EDGERT_TenGi12", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T13:38:06.281580Z", "routing_process": "ospf", "pid": 3243, "stuck_minutes": 9, "symptom": "BGP scanner unresponsive", "description": "Routing process 'ospf' appears hung (pid=3243), stuck for ~9 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios", "routing_process": "ospf", "pid": 3243, "stuck_minutes": 9}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T15:42:06.281714Z", "routing_process": "isis", "pid": 2895, "stuck_minutes": 9, "symptom": "BGP scanner unresponsive", "description": "Routing process 'isis' appears hung (pid=2895), stuck for ~9 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "routing_process": "isis", "pid": 2895, "stuck_minutes": 9}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T13:11:06.286217Z", "interface": "GigabitEthernet1/0", "class": "VOICE", "drop_rate_pct": 39, "current_rate_kbps": 20000, "suggested_rate_kbps": 40000, "reason": "rate too low", "description": "Policing drops on GigabitEthernet1/0 class=VOICE. Current rate 20000 kbps; drops due to rate too low."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "class": "VOICE", "current_rate_kbps": 20000, "suggested_rate_kbps": 40000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 40000 32000 conform-action transmit exceed-action drop", "interface GigabitEthernet1/0", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T13:21:06.284667Z", "interface": "TenGigabitEthernet1/1", "application": "backup", "expected_dscp": "cs0", "observed_dscp": "af31", "vlan": 40, "description": "QoS misclassification on TenGigabitEthernet1/1: app=backup, expected DSCP=cs0, observed DSCP=af31 (VLAN 40)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "vlan": 40, "expected_dscp": "cs0", "observed_dscp": "af31"}], "cli_fix": ["class-map match-any CM_EDGERT_TenGi11", " match vlan 40", "policy-map PM_EDGERT_TenGi11", " class CM_EDGERT_TenGi11", "  set dscp cs0", "interface TenGigabitEthernet1/1", " service-policy input PM_EDGERT_TenGi11", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T17:26:06.288015Z", "interface": "TenGigabitEthernet1/2", "class": "DATA", "drop_rate_pct": 10, "current_rate_kbps": 2000, "suggested_rate_kbps": 6000, "reason": "policer exceed drops", "description": "Policing drops on TenGigabitEthernet1/2 class=DATA. Current rate 2000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/2", "class": "DATA", "current_rate_kbps": 2000, "suggested_rate_kbps": 6000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 6000 32000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T17:59:06.280031Z", "routing_process": "eigrp", "pid": 936, "stuck_minutes": 39, "symptom": "Routing table not updating", "description": "Routing process 'eigrp' appears hung (pid=936), stuck for ~39 minutes. Symptom: Routing table not updating."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "routing_process": "eigrp", "pid": 936, "stuck_minutes": 39}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T18:11:06.286771Z", "interface": "GigabitEthernet1/0", "class": "DATA", "drop_rate_pct": 23, "current_rate_kbps": 2000, "suggested_rate_kbps": 6000, "reason": "policer exceed drops", "description": "Policing drops on GigabitEthernet1/0 class=DATA. Current rate 2000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "class": "DATA", "current_rate_kbps": 2000, "suggested_rate_kbps": 6000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 6000 16000 conform-action transmit exceed-action drop", "interface GigabitEthernet1/0", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T11:50:06.284178Z", "interface": "GigabitEthernet0/0", "application": "web", "expected_dscp": "cs3", "observed_dscp": "af31", "vlan": 20, "description": "QoS misclassification on GigabitEthernet0/0: app=web, expected DSCP=cs3, observed DSCP=af31 (VLAN 20)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "vlan": 20, "expected_dscp": "cs3", "observed_dscp": "af31"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi00", " match vlan 20", "policy-map PM_BRANCH_Gi00", " class CM_BRANCH_Gi00", "  set dscp cs3", "interface GigabitEthernet0/0", " service-policy input PM_BRANCH_Gi00", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T12:06:06.283353Z", "interface": "GigabitEthernet0/0", "application": "erp", "expected_dscp": "cs0", "observed_dscp": "cs3", "vlan": 10, "description": "QoS misclassification on GigabitEthernet0/0: app=erp, expected DSCP=cs0, observed DSCP=cs3 (VLAN 10)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "vlan": 10, "expected_dscp": "cs0", "observed_dscp": "cs3"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi00", " match vlan 10", "policy-map PM_BRANCH_Gi00", " class CM_BRANCH_Gi00", "  set dscp cs0", "interface GigabitEthernet0/0", " service-policy input PM_BRANCH_Gi00", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T14:46:06.287227Z", "interface": "TenGigabitEthernet1/1", "class": "BULK", "drop_rate_pct": 38, "current_rate_kbps": 5000, "suggested_rate_kbps": 10000, "reason": "burst too small", "description": "Policing drops on TenGigabitEthernet1/1 class=BULK. Current rate 5000 kbps; drops due to burst too small."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "class": "BULK", "current_rate_kbps": 5000, "suggested_rate_kbps": 10000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 10000 32000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T17:59:06.283485Z", "interface": "TenGigabitEthernet1/1", "application": "video", "expected_dscp": "af31", "observed_dscp": "cs3", "vlan": 50, "description": "QoS misclassification on TenGigabitEthernet1/1: app=video, expected DSCP=af31, observed DSCP=cs3 (VLAN 50)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "vlan": 50, "expected_dscp": "af31", "observed_dscp": "cs3"}], "cli_fix": ["class-map match-any CM_BRANCH_TenGi11", " match vlan 50", "policy-map PM_BRANCH_TenGi11", " class CM_BRANCH_TenGi11", "  set dscp af31", "interface TenGigabitEthernet1/1", " service-policy input PM_BRANCH_TenGi11", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T15:39:06.281840Z", "interface": "GigabitEthernet0/0", "application": "web", "expected_dscp": "cs0", "observed_dscp": "ef", "vlan": 40, "description": "QoS misclassification on GigabitEthernet0/0: app=web, expected DSCP=cs0, observed DSCP=ef (VLAN 40)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "vlan": 40, "expected_dscp": "cs0", "observed_dscp": "ef"}], "cli_fix": ["class-map match-any CM_CORER2_Gi00", " match vlan 40", "policy-map PM_CORER2_Gi00", " class CM_CORER2_Gi00", "  set dscp cs0", "interface GigabitEthernet0/0", " service-policy input PM_CORER2_Gi00", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T12:16:06.287147Z", "interface": "TenGigabitEthernet1/1", "class": "VIDEO", "drop_rate_pct": 28, "current_rate_kbps": 2000, "suggested_rate_kbps": 4000, "reason": "token bucket depleted", "description": "Policing drops on TenGigabitEthernet1/1 class=VIDEO. Current rate 2000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "class": "VIDEO", "current_rate_kbps": 2000, "suggested_rate_kbps": 4000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 4000 32000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T17:11:06.281556Z", "routing_process": "ospf", "pid": 4910, "stuck_minutes": 21, "symptom": "RIB update stalled", "description": "Routing process 'ospf' appears hung (pid=4910), stuck for ~21 minutes. Symptom: RIB update stalled."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "routing_process": "ospf", "pid": 4910, "stuck_minutes": 21}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T15:56:06.288230Z", "interface": "GigabitEthernet0/1", "class": "BULK", "drop_rate_pct": 24, "current_rate_kbps": 20000, "suggested_rate_kbps": 60000, "reason": "rate too low", "description": "Policing drops on GigabitEthernet0/1 class=BULK. Current rate 20000 kbps; drops due to rate too low."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "class": "BULK", "current_rate_kbps": 20000, "suggested_rate_kbps": 60000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 60000 64000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T12:04:06.283018Z", "interface": "GigabitEthernet0/0", "application": "video", "expected_dscp": "af41", "observed_dscp": "af31", "vlan": 10, "description": "QoS misclassification on GigabitEthernet0/0: app=video, expected DSCP=af41, observed DSCP=af31 (VLAN 10)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "vlan": 10, "expected_dscp": "af41", "observed_dscp": "af31"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi00", " match vlan 10", "policy-map PM_BRANCH_Gi00", " class CM_BRANCH_Gi00", "  set dscp af41", "interface GigabitEthernet0/0", " service-policy input PM_BRANCH_Gi00", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T15:04:06.281064Z", "routing_process": "eigrp", "pid": 2823, "stuck_minutes": 9, "symptom": "Adjacency state not progressing", "description": "Routing process 'eigrp' appears hung (pid=2823), stuck for ~9 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "routing_process": "eigrp", "pid": 2823, "stuck_minutes": 9}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T16:22:06.288317Z", "interface": "TenGigabitEthernet1/2", "class": "VIDEO", "drop_rate_pct": 27, "current_rate_kbps": 1000, "suggested_rate_kbps": 2000, "reason": "token bucket depleted", "description": "Policing drops on TenGigabitEthernet1/2 class=VIDEO. Current rate 1000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "class": "VIDEO", "current_rate_kbps": 1000, "suggested_rate_kbps": 2000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 2000 64000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T19:59:06.287720Z", "interface": "TenGigabitEthernet1/2", "class": "BULK", "drop_rate_pct": 40, "current_rate_kbps": 1000, "suggested_rate_kbps": 2000, "reason": "token bucket depleted", "description": "Policing drops on TenGigabitEthernet1/2 class=BULK. Current rate 1000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "class": "BULK", "current_rate_kbps": 1000, "suggested_rate_kbps": 2000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 2000 8000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T15:57:06.286165Z", "interface": "GigabitEthernet0/1", "class": "DATA", "drop_rate_pct": 27, "current_rate_kbps": 20000, "suggested_rate_kbps": 40000, "reason": "rate too low", "description": "Policing drops on GigabitEthernet0/1 class=DATA. Current rate 20000 kbps; drops due to rate too low."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "class": "DATA", "current_rate_kbps": 20000, "suggested_rate_kbps": 40000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 40000 32000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T17:06:06.282782Z", "interface": "GigabitEthernet1/0", "application": "voice", "expected_dscp": "cs3", "observed_dscp": "cs0", "vlan": 40, "description": "QoS misclassification on GigabitEthernet1/0: app=voice, expected DSCP=cs3, observed DSCP=cs0 (VLAN 40)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "vlan": 40, "expected_dscp": "cs3", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi10", " match vlan 40", "policy-map PM_BRANCH_Gi10", " class CM_BRANCH_Gi10", "  set dscp cs3", "interface GigabitEthernet1/0", " service-policy input PM_BRANCH_Gi10", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T17:24:06.280668Z", "routing_process": "ospf", "pid": 2957, "stuck_minutes": 16, "symptom": "Adjacency state not progressing", "description": "Routing process 'ospf' appears hung (pid=2957), stuck for ~16 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "routing_process": "ospf", "pid": 2957, "stuck_minutes": 16}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T15:06:06.285256Z", "interface": "GigabitEthernet0/1", "application": "video", "expected_dscp": "cs0", "observed_dscp": "af31", "vlan": 40, "description": "QoS misclassification on GigabitEthernet0/1: app=video, expected DSCP=cs0, observed DSCP=af31 (VLAN 40)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "vlan": 40, "expected_dscp": "cs0", "observed_dscp": "af31"}], "cli_fix": ["class-map match-any CM_EDGERT_Gi01", " match vlan 40", "policy-map PM_EDGERT_Gi01", " class CM_EDGERT_Gi01", "  set dscp cs0", "interface GigabitEthernet0/1", " service-policy input PM_EDGERT_Gi01", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:55:06.279679Z", "routing_process": "ospf", "pid": 4506, "stuck_minutes": 27, "symptom": "Adjacency state not progressing", "description": "Routing process 'ospf' appears hung (pid=4506), stuck for ~27 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios", "routing_process": "ospf", "pid": 4506, "stuck_minutes": 27}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T20:33:06.285850Z", "interface": "TenGigabitEthernet1/1", "class": "VIDEO", "drop_rate_pct": 35, "current_rate_kbps": 1000, "suggested_rate_kbps": 2000, "reason": "policer exceed drops", "description": "Policing drops on TenGigabitEthernet1/1 class=VIDEO. Current rate 1000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "class": "VIDEO", "current_rate_kbps": 1000, "suggested_rate_kbps": 2000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 2000 16000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T15:05:06.280598Z", "routing_process": "ospf", "pid": 3187, "stuck_minutes": 44, "symptom": "SPF calculation stuck", "description": "Routing process 'ospf' appears hung (pid=3187), stuck for ~44 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "routing_process": "ospf", "pid": 3187, "stuck_minutes": 44}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T15:01:06.281009Z", "routing_process": "eigrp", "pid": 414, "stuck_minutes": 4, "symptom": "SPF calculation stuck", "description": "Routing process 'eigrp' appears hung (pid=414), stuck for ~4 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "routing_process": "eigrp", "pid": 414, "stuck_minutes": 4}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T18:24:06.280529Z", "routing_process": "bgp", "pid": 4569, "stuck_minutes": 44, "symptom": "Adjacency state not progressing", "description": "Routing process 'bgp' appears hung (pid=4569), stuck for ~44 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "routing_process": "bgp", "pid": 4569, "stuck_minutes": 44}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T17:42:06.280790Z", "routing_process": "ospf", "pid": 4400, "stuck_minutes": 3, "symptom": "SPF calculation stuck", "description": "Routing process 'ospf' appears hung (pid=4400), stuck for ~3 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "routing_process": "ospf", "pid": 4400, "stuck_minutes": 3}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T13:17:06.280322Z", "routing_process": "eigrp", "pid": 2122, "stuck_minutes": 35, "symptom": "SPF calculation stuck", "description": "Routing process 'eigrp' appears hung (pid=2122), stuck for ~35 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "routing_process": "eigrp", "pid": 2122, "stuck_minutes": 35}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T15:53:06.286672Z", "interface": "TenGigabitEthernet1/1", "class": "DATA", "drop_rate_pct": 6, "current_rate_kbps": 2000, "suggested_rate_kbps": 6000, "reason": "token bucket depleted", "description": "Policing drops on TenGigabitEthernet1/1 class=DATA. Current rate 2000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "class": "DATA", "current_rate_kbps": 2000, "suggested_rate_kbps": 6000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 6000 32000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T17:59:06.279825Z", "routing_process": "bgp", "pid": 4504, "stuck_minutes": 35, "symptom": "RIB update stalled", "description": "Routing process 'bgp' appears hung (pid=4504), stuck for ~35 minutes. Symptom: RIB update stalled."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "routing_process": "bgp", "pid": 4504, "stuck_minutes": 35}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T20:38:06.287579Z", "interface": "GigabitEthernet0/0", "class": "BULK", "drop_rate_pct": 37, "current_rate_kbps": 2000, "suggested_rate_kbps": 6000, "reason": "burst too small", "description": "Policing drops on GigabitEthernet0/0 class=BULK. Current rate 2000 kbps; drops due to burst too small."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "class": "BULK", "current_rate_kbps": 2000, "suggested_rate_kbps": 6000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 6000 64000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/0", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T16:45:06.280566Z", "routing_process": "bgp", "pid": 1857, "stuck_minutes": 27, "symptom": "BGP scanner unresponsive", "description": "Routing process 'bgp' appears hung (pid=1857), stuck for ~27 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "routing_process": "bgp", "pid": 1857, "stuck_minutes": 27}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T13:11:06.283139Z", "interface": "TenGigabitEthernet1/1", "application": "voice", "expected_dscp": "ef", "observed_dscp": "cs0", "vlan": 30, "description": "QoS misclassification on TenGigabitEthernet1/1: app=voice, expected DSCP=ef, observed DSCP=cs0 (VLAN 30)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "vlan": 30, "expected_dscp": "ef", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_CORER1_TenGi11", " match vlan 30", "policy-map PM_CORER1_TenGi11", " class CM_CORER1_TenGi11", "  set dscp ef", "interface TenGigabitEthernet1/1", " service-policy input PM_CORER1_TenGi11", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T17:51:06.286399Z", "interface": "GigabitEthernet0/0", "class": "VOICE", "drop_rate_pct": 36, "current_rate_kbps": 20000, "suggested_rate_kbps": 40000, "reason": "burst too small", "description": "Policing drops on GigabitEthernet0/0 class=VOICE. Current rate 20000 kbps; drops due to burst too small."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "class": "VOICE", "current_rate_kbps": 20000, "suggested_rate_kbps": 40000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 40000 32000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/0", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T16:47:06.282839Z", "interface": "GigabitEthernet0/0", "application": "voice", "expected_dscp": "af41", "observed_dscp": "cs0", "vlan": 50, "description": "QoS misclassification on GigabitEthernet0/0: app=voice, expected DSCP=af41, observed DSCP=cs0 (VLAN 50)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "vlan": 50, "expected_dscp": "af41", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_CORER2_Gi00", " match vlan 50", "policy-map PM_CORER2_Gi00", " class CM_CORER2_Gi00", "  set dscp af41", "interface GigabitEthernet0/0", " service-policy input PM_CORER2_Gi00", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T12:15:06.287452Z", "interface": "TenGigabitEthernet1/1", "class": "VIDEO", "drop_rate_pct": 6, "current_rate_kbps": 2000, "suggested_rate_kbps": 4000, "reason": "rate too low", "description": "Policing drops on TenGigabitEthernet1/1 class=VIDEO. Current rate 2000 kbps; drops due to rate too low."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "class": "VIDEO", "current_rate_kbps": 2000, "suggested_rate_kbps": 4000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 4000 32000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T20:59:06.284379Z", "interface": "TenGigabitEthernet1/1", "application": "erp", "expected_dscp": "af31", "observed_dscp": "ef", "vlan": 50, "description": "QoS misclassification on TenGigabitEthernet1/1: app=erp, expected DSCP=af31, observed DSCP=ef (VLAN 50)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "vlan": 50, "expected_dscp": "af31", "observed_dscp": "ef"}], "cli_fix": ["class-map match-any CM_EDGERT_TenGi11", " match vlan 50", "policy-map PM_EDGERT_TenGi11", " class CM_EDGERT_TenGi11", "  set dscp af31", "interface TenGigabitEthernet1/1", " service-policy input PM_EDGERT_TenGi11", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T17:01:06.287172Z", "interface": "TenGigabitEthernet1/1", "class": "BULK", "drop_rate_pct": 39, "current_rate_kbps": 2000, "suggested_rate_kbps": 4000, "reason": "policer exceed drops", "description": "Policing drops on TenGigabitEthernet1/1 class=BULK. Current rate 2000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "class": "BULK", "current_rate_kbps": 2000, "suggested_rate_kbps": 4000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 4000 32000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T20:58:06.285796Z", "interface": "TenGigabitEthernet1/1", "class": "VIDEO", "drop_rate_pct": 29, "current_rate_kbps": 1000, "suggested_rate_kbps": 2000, "reason": "burst too small", "description": "Policing drops on TenGigabitEthernet1/1 class=VIDEO. Current rate 1000 kbps; drops due to burst too small."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "class": "VIDEO", "current_rate_kbps": 1000, "suggested_rate_kbps": 2000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 2000 8000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T15:37:06.288251Z", "interface": "GigabitEthernet0/0", "class": "DATA", "drop_rate_pct": 33, "current_rate_kbps": 10000, "suggested_rate_kbps": 20000, "reason": "burst too small", "description": "Policing drops on GigabitEthernet0/0 class=DATA. Current rate 10000 kbps; drops due to burst too small."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "class": "DATA", "current_rate_kbps": 10000, "suggested_rate_kbps": 20000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 20000 32000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/0", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T12:17:06.285101Z", "interface": "GigabitEthernet1/0", "application": "web", "expected_dscp": "cs0", "observed_dscp": "af21", "vlan": 20, "description": "QoS misclassification on GigabitEthernet1/0: app=web, expected DSCP=cs0, observed DSCP=af21 (VLAN 20)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "vlan": 20, "expected_dscp": "cs0", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_CORER1_Gi10", " match vlan 20", "policy-map PM_CORER1_Gi10", " class CM_CORER1_Gi10", "  set dscp cs0", "interface GigabitEthernet1/0", " service-policy input PM_CORER1_Gi10", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T12:06:06.280981Z", "routing_process": "eigrp", "pid": 3694, "stuck_minutes": 44, "symptom": "Routing table not updating", "description": "Routing process 'eigrp' appears hung (pid=3694), stuck for ~44 minutes. Symptom: Routing table not updating."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios_xe", "routing_process": "eigrp", "pid": 3694, "stuck_minutes": 44}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T19:31:06.281655Z", "routing_process": "isis", "pid": 1002, "stuck_minutes": 7, "symptom": "Adjacency state not progressing", "description": "Routing process 'isis' appears hung (pid=1002), stuck for ~7 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "routing_process": "isis", "pid": 1002, "stuck_minutes": 7}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T13:51:06.284528Z", "interface": "GigabitEthernet0/1", "application": "web", "expected_dscp": "ef", "observed_dscp": "af31", "vlan": 10, "description": "QoS misclassification on GigabitEthernet0/1: app=web, expected DSCP=ef, observed DSCP=af31 (VLAN 10)."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "vlan": 10, "expected_dscp": "ef", "observed_dscp": "af31"}], "cli_fix": ["class-map match-any CM_DCR1_Gi01", " match vlan 10", "policy-map PM_DCR1_Gi01", " class CM_DCR1_Gi01", "  set dscp ef", "interface GigabitEthernet0/1", " service-policy input PM_DCR1_Gi01", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T16:23:06.283153Z", "interface": "GigabitEthernet1/0", "application": "web", "expected_dscp": "af21", "observed_dscp": "cs3", "vlan": 10, "description": "QoS misclassification on GigabitEthernet1/0: app=web, expected DSCP=af21, observed DSCP=cs3 (VLAN 10)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "vlan": 10, "expected_dscp": "af21", "observed_dscp": "cs3"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi10", " match vlan 10", "policy-map PM_BRANCH_Gi10", " class CM_BRANCH_Gi10", "  set dscp af21", "interface GigabitEthernet1/0", " service-policy input PM_BRANCH_Gi10", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T11:43:06.285585Z", "interface": "GigabitEthernet1/0", "class": "VIDEO", "drop_rate_pct": 15, "current_rate_kbps": 2000, "suggested_rate_kbps": 6000, "reason": "rate too low", "description": "Policing drops on GigabitEthernet1/0 class=VIDEO. Current rate 2000 kbps; drops due to rate too low."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "class": "VIDEO", "current_rate_kbps": 2000, "suggested_rate_kbps": 6000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 6000 32000 conform-action transmit exceed-action drop", "interface GigabitEthernet1/0", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:47:06.287976Z", "interface": "GigabitEthernet0/0", "class": "VOICE", "drop_rate_pct": 20, "current_rate_kbps": 20000, "suggested_rate_kbps": 40000, "reason": "policer exceed drops", "description": "Policing drops on GigabitEthernet0/0 class=VOICE. Current rate 20000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "class": "VOICE", "current_rate_kbps": 20000, "suggested_rate_kbps": 40000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 40000 32000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/0", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T16:36:06.285221Z", "interface": "TenGigabitEthernet1/1", "application": "web", "expected_dscp": "af41", "observed_dscp": "cs3", "vlan": 20, "description": "QoS misclassification on TenGigabitEthernet1/1: app=web, expected DSCP=af41, observed DSCP=cs3 (VLAN 20)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "vlan": 20, "expected_dscp": "af41", "observed_dscp": "cs3"}], "cli_fix": ["class-map match-any CM_EDGERT_TenGi11", " match vlan 20", "policy-map PM_EDGERT_TenGi11", " class CM_EDGERT_TenGi11", "  set dscp af41", "interface TenGigabitEthernet1/1", " service-policy input PM_EDGERT_TenGi11", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T18:54:06.281411Z", "routing_process": "ospf", "pid": 3022, "stuck_minutes": 28, "symptom": "Adjacency state not progressing", "description": "Routing process 'ospf' appears hung (pid=3022), stuck for ~28 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "routing_process": "ospf", "pid": 3022, "stuck_minutes": 28}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T15:33:06.283942Z", "interface": "GigabitEthernet0/1", "application": "video", "expected_dscp": "af21", "observed_dscp": "cs0", "vlan": 50, "description": "QoS misclassification on GigabitEthernet0/1: app=video, expected DSCP=af21, observed DSCP=cs0 (VLAN 50)."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "vlan": 50, "expected_dscp": "af21", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_DCR2_Gi01", " match vlan 50", "policy-map PM_DCR2_Gi01", " class CM_DCR2_Gi01", "  set dscp af21", "interface GigabitEthernet0/1", " service-policy input PM_DCR2_Gi01", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T14:23:06.279621Z", "routing_process": "isis", "pid": 2472, "stuck_minutes": 22, "symptom": "SPF calculation stuck", "description": "Routing process 'isis' appears hung (pid=2472), stuck for ~22 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "routing_process": "isis", "pid": 2472, "stuck_minutes": 22}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T19:56:06.282891Z", "interface": "TenGigabitEthernet1/1", "application": "video", "expected_dscp": "cs3", "observed_dscp": "af21", "vlan": 30, "description": "QoS misclassification on TenGigabitEthernet1/1: app=video, expected DSCP=cs3, observed DSCP=af21 (VLAN 30)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "vlan": 30, "expected_dscp": "cs3", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_BRANCH_TenGi11", " match vlan 30", "policy-map PM_BRANCH_TenGi11", " class CM_BRANCH_TenGi11", "  set dscp cs3", "interface TenGigabitEthernet1/1", " service-policy input PM_BRANCH_TenGi11", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T15:04:06.282963Z", "interface": "GigabitEthernet1/0", "application": "voice", "expected_dscp": "af41", "observed_dscp": "ef", "vlan": 10, "description": "QoS misclassification on GigabitEthernet1/0: app=voice, expected DSCP=af41, observed DSCP=ef (VLAN 10)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "vlan": 10, "expected_dscp": "af41", "observed_dscp": "ef"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi10", " match vlan 10", "policy-map PM_BRANCH_Gi10", " class CM_BRANCH_Gi10", "  set dscp af41", "interface GigabitEthernet1/0", " service-policy input PM_BRANCH_Gi10", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T16:04:06.286551Z", "interface": "TenGigabitEthernet1/1", "class": "BULK", "drop_rate_pct": 34, "current_rate_kbps": 2000, "suggested_rate_kbps": 4000, "reason": "token bucket depleted", "description": "Policing drops on TenGigabitEthernet1/1 class=BULK. Current rate 2000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "class": "BULK", "current_rate_kbps": 2000, "suggested_rate_kbps": 4000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 4000 8000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T17:04:06.283603Z", "interface": "GigabitEthernet0/0", "application": "voice", "expected_dscp": "af41", "observed_dscp": "af21", "vlan": 30, "description": "QoS misclassification on GigabitEthernet0/0: app=voice, expected DSCP=af41, observed DSCP=af21 (VLAN 30)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "vlan": 30, "expected_dscp": "af41", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_EDGERT_Gi00", " match vlan 30", "policy-map PM_EDGERT_Gi00", " class CM_EDGERT_Gi00", "  set dscp af41", "interface GigabitEthernet0/0", " service-policy input PM_EDGERT_Gi00", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:04:06.287807Z", "interface": "TenGigabitEthernet1/1", "class": "BULK", "drop_rate_pct": 16, "current_rate_kbps": 5000, "suggested_rate_kbps": 15000, "reason": "policer exceed drops", "description": "Policing drops on TenGigabitEthernet1/1 class=BULK. Current rate 5000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "class": "BULK", "current_rate_kbps": 5000, "suggested_rate_kbps": 15000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 15000 8000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T18:53:06.286875Z", "interface": "GigabitEthernet1/0", "class": "DATA", "drop_rate_pct": 24, "current_rate_kbps": 10000, "suggested_rate_kbps": 30000, "reason": "policer exceed drops", "description": "Policing drops on GigabitEthernet1/0 class=DATA. Current rate 10000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "class": "DATA", "current_rate_kbps": 10000, "suggested_rate_kbps": 30000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 30000 32000 conform-action transmit exceed-action drop", "interface GigabitEthernet1/0", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T20:01:06.282899Z", "interface": "TenGigabitEthernet1/2", "application": "backup", "expected_dscp": "af41", "observed_dscp": "cs0", "vlan": 30, "description": "QoS misclassification on TenGigabitEthernet1/2: app=backup, expected DSCP=af41, observed DSCP=cs0 (VLAN 30)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "vlan": 30, "expected_dscp": "af41", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_EDGERT_TenGi12", " match vlan 30", "policy-map PM_EDGERT_TenGi12", " class CM_EDGERT_TenGi12", "  set dscp af41", "interface TenGigabitEthernet1/2", " service-policy input PM_EDGERT_TenGi12", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T13:51:06.285664Z", "interface": "TenGigabitEthernet1/1", "class": "BULK", "drop_rate_pct": 11, "current_rate_kbps": 20000, "suggested_rate_kbps": 40000, "reason": "policer exceed drops", "description": "Policing drops on TenGigabitEthernet1/1 class=BULK. Current rate 20000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "class": "BULK", "current_rate_kbps": 20000, "suggested_rate_kbps": 40000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 40000 32000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T18:04:06.287016Z", "interface": "GigabitEthernet0/1", "class": "BULK", "drop_rate_pct": 18, "current_rate_kbps": 20000, "suggested_rate_kbps": 60000, "reason": "policer exceed drops", "description": "Policing drops on GigabitEthernet0/1 class=BULK. Current rate 20000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "class": "BULK", "current_rate_kbps": 20000, "suggested_rate_kbps": 60000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 60000 64000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T17:16:06.286072Z", "interface": "TenGigabitEthernet1/1", "class": "VOICE", "drop_rate_pct": 17, "current_rate_kbps": 2000, "suggested_rate_kbps": 6000, "reason": "rate too low", "description": "Policing drops on TenGigabitEthernet1/1 class=VOICE. Current rate 2000 kbps; drops due to rate too low."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "class": "VOICE", "current_rate_kbps": 2000, "suggested_rate_kbps": 6000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 6000 64000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T14:52:06.285194Z", "interface": "TenGigabitEthernet1/1", "application": "voice", "expected_dscp": "af21", "observed_dscp": "ef", "vlan": 20, "description": "QoS misclassification on TenGigabitEthernet1/1: app=voice, expected DSCP=af21, observed DSCP=ef (VLAN 20)."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "vlan": 20, "expected_dscp": "af21", "observed_dscp": "ef"}], "cli_fix": ["class-map match-any CM_DCR1_TenGi11", " match vlan 20", "policy-map PM_DCR1_TenGi11", " class CM_DCR1_TenGi11", "  set dscp af21", "interface TenGigabitEthernet1/1", " service-policy input PM_DCR1_TenGi11", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T11:58:06.282347Z", "interface": "TenGigabitEthernet1/2", "application": "erp", "expected_dscp": "af21", "observed_dscp": "af41", "vlan": 20, "description": "QoS misclassification on TenGigabitEthernet1/2: app=erp, expected DSCP=af21, observed DSCP=af41 (VLAN 20)."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/2", "vlan": 20, "expected_dscp": "af21", "observed_dscp": "af41"}], "cli_fix": ["class-map match-any CM_DCR2_TenGi12", " match vlan 20", "policy-map PM_DCR2_TenGi12", " class CM_DCR2_TenGi12", "  set dscp af21", "interface TenGigabitEthernet1/2", " service-policy input PM_DCR2_TenGi12", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:47:06.283306Z", "interface": "TenGigabitEthernet1/1", "application": "voice", "expected_dscp": "af41", "observed_dscp": "af31", "vlan": 50, "description": "QoS misclassification on TenGigabitEthernet1/1: app=voice, expected DSCP=af41, observed DSCP=af31 (VLAN 50)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "vlan": 50, "expected_dscp": "af41", "observed_dscp": "af31"}], "cli_fix": ["class-map match-any CM_EDGERT_TenGi11", " match vlan 50", "policy-map PM_EDGERT_TenGi11", " class CM_EDGERT_TenGi11", "  set dscp af41", "interface TenGigabitEthernet1/1", " service-policy input PM_EDGERT_TenGi11", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T20:08:06.281288Z", "routing_process": "eigrp", "pid": 2782, "stuck_minutes": 13, "symptom": "Adjacency state not progressing", "description": "Routing process 'eigrp' appears hung (pid=2782), stuck for ~13 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios", "routing_process": "eigrp", "pid": 2782, "stuck_minutes": 13}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T18:15:06.284579Z", "interface": "GigabitEthernet0/0", "application": "web", "expected_dscp": "af41", "observed_dscp": "cs0", "vlan": 40, "description": "QoS misclassification on GigabitEthernet0/0: app=web, expected DSCP=af41, observed DSCP=cs0 (VLAN 40)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "vlan": 40, "expected_dscp": "af41", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_CORER1_Gi00", " match vlan 40", "policy-map PM_CORER1_Gi00", " class CM_CORER1_Gi00", "  set dscp af41", "interface GigabitEthernet0/0", " service-policy input PM_CORER1_Gi00", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T12:34:06.286649Z", "interface": "GigabitEthernet1/0", "class": "VIDEO", "drop_rate_pct": 37, "current_rate_kbps": 5000, "suggested_rate_kbps": 15000, "reason": "burst too small", "description": "Policing drops on GigabitEthernet1/0 class=VIDEO. Current rate 5000 kbps; drops due to burst too small."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "class": "VIDEO", "current_rate_kbps": 5000, "suggested_rate_kbps": 15000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 15000 8000 conform-action transmit exceed-action drop", "interface GigabitEthernet1/0", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T13:16:06.283338Z", "interface": "TenGigabitEthernet1/1", "application": "video", "expected_dscp": "cs3", "observed_dscp": "af21", "vlan": 40, "description": "QoS misclassification on TenGigabitEthernet1/1: app=video, expected DSCP=cs3, observed DSCP=af21 (VLAN 40)."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "vlan": 40, "expected_dscp": "cs3", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_DCR1_TenGi11", " match vlan 40", "policy-map PM_DCR1_TenGi11", " class CM_DCR1_TenGi11", "  set dscp cs3", "interface TenGigabitEthernet1/1", " service-policy input PM_DCR1_TenGi11", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T15:11:06.281294Z", "routing_process": "eigrp", "pid": 228, "stuck_minutes": 39, "symptom": "BGP scanner unresponsive", "description": "Routing process 'eigrp' appears hung (pid=228), stuck for ~39 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "routing_process": "eigrp", "pid": 228, "stuck_minutes": 39}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T14:37:06.280335Z", "routing_process": "eigrp", "pid": 628, "stuck_minutes": 20, "symptom": "SPF calculation stuck", "description": "Routing process 'eigrp' appears hung (pid=628), stuck for ~20 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios_xe", "routing_process": "eigrp", "pid": 628, "stuck_minutes": 20}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:41:06.279734Z", "routing_process": "bgp", "pid": 4212, "stuck_minutes": 10, "symptom": "SPF calculation stuck", "description": "Routing process 'bgp' appears hung (pid=4212), stuck for ~10 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "routing_process": "bgp", "pid": 4212, "stuck_minutes": 10}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T15:21:06.281021Z", "routing_process": "bgp", "pid": 4481, "stuck_minutes": 45, "symptom": "Routing table not updating", "description": "Routing process 'bgp' appears hung (pid=4481), stuck for ~45 minutes. Symptom: Routing table not updating."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "routing_process": "bgp", "pid": 4481, "stuck_minutes": 45}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T16:57:06.287782Z", "interface": "GigabitEthernet0/1", "class": "VOICE", "drop_rate_pct": 19, "current_rate_kbps": 1000, "suggested_rate_kbps": 3000, "reason": "policer exceed drops", "description": "Policing drops on GigabitEthernet0/1 class=VOICE. Current rate 1000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "class": "VOICE", "current_rate_kbps": 1000, "suggested_rate_kbps": 3000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 3000 8000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T18:47:06.280328Z", "routing_process": "ospf", "pid": 4300, "stuck_minutes": 31, "symptom": "SPF calculation stuck", "description": "Routing process 'ospf' appears hung (pid=4300), stuck for ~31 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "routing_process": "ospf", "pid": 4300, "stuck_minutes": 31}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T20:38:06.283934Z", "interface": "GigabitEthernet0/1", "application": "video", "expected_dscp": "ef", "observed_dscp": "cs0", "vlan": 40, "description": "QoS misclassification on GigabitEthernet0/1: app=video, expected DSCP=ef, observed DSCP=cs0 (VLAN 40)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "vlan": 40, "expected_dscp": "ef", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi01", " match vlan 40", "policy-map PM_BRANCH_Gi01", " class CM_BRANCH_Gi01", "  set dscp ef", "interface GigabitEthernet0/1", " service-policy input PM_BRANCH_Gi01", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:36:06.281223Z", "routing_process": "isis", "pid": 519, "stuck_minutes": 6, "symptom": "SPF calculation stuck", "description": "Routing process 'isis' appears hung (pid=519), stuck for ~6 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "routing_process": "isis", "pid": 519, "stuck_minutes": 6}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T14:09:06.284426Z", "interface": "TenGigabitEthernet1/1", "application": "voice", "expected_dscp": "cs0", "observed_dscp": "af31", "vlan": 40, "description": "QoS misclassification on TenGigabitEthernet1/1: app=voice, expected DSCP=cs0, observed DSCP=af31 (VLAN 40)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "vlan": 40, "expected_dscp": "cs0", "observed_dscp": "af31"}], "cli_fix": ["class-map match-any CM_EDGERT_TenGi11", " match vlan 40", "policy-map PM_EDGERT_TenGi11", " class CM_EDGERT_TenGi11", "  set dscp cs0", "interface TenGigabitEthernet1/1", " service-policy input PM_EDGERT_TenGi11", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T20:03:06.283456Z", "interface": "TenGigabitEthernet1/1", "application": "erp", "expected_dscp": "af21", "observed_dscp": "cs3", "vlan": 20, "description": "QoS misclassification on TenGigabitEthernet1/1: app=erp, expected DSCP=af21, observed DSCP=cs3 (VLAN 20)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "vlan": 20, "expected_dscp": "af21", "observed_dscp": "cs3"}], "cli_fix": ["class-map match-any CM_BRANCH_TenGi11", " match vlan 20", "policy-map PM_BRANCH_TenGi11", " class CM_BRANCH_TenGi11", "  set dscp af21", "interface TenGigabitEthernet1/1", " service-policy input PM_BRANCH_TenGi11", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T13:04:06.280425Z", "routing_process": "ospf", "pid": 2410, "stuck_minutes": 45, "symptom": "Routing table not updating", "description": "Routing process 'ospf' appears hung (pid=2410), stuck for ~45 minutes. Symptom: Routing table not updating."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "routing_process": "ospf", "pid": 2410, "stuck_minutes": 45}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T18:58:06.280153Z", "routing_process": "isis", "pid": 1761, "stuck_minutes": 29, "symptom": "Routing table not updating", "description": "Routing process 'isis' appears hung (pid=1761), stuck for ~29 minutes. Symptom: Routing table not updating."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "routing_process": "isis", "pid": 1761, "stuck_minutes": 29}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T16:08:06.280500Z", "routing_process": "isis", "pid": 4817, "stuck_minutes": 39, "symptom": "Adjacency state not progressing", "description": "Routing process 'isis' appears hung (pid=4817), stuck for ~39 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "routing_process": "isis", "pid": 4817, "stuck_minutes": 39}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T15:03:06.288355Z", "interface": "GigabitEthernet0/1", "class": "VIDEO", "drop_rate_pct": 12, "current_rate_kbps": 10000, "suggested_rate_kbps": 20000, "reason": "policer exceed drops", "description": "Policing drops on GigabitEthernet0/1 class=VIDEO. Current rate 10000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "class": "VIDEO", "current_rate_kbps": 10000, "suggested_rate_kbps": 20000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 20000 16000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T19:00:06.280314Z", "routing_process": "bgp", "pid": 719, "stuck_minutes": 36, "symptom": "RIB update stalled", "description": "Routing process 'bgp' appears hung (pid=719), stuck for ~36 minutes. Symptom: RIB update stalled."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "routing_process": "bgp", "pid": 719, "stuck_minutes": 36}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T21:14:06.284598Z", "interface": "TenGigabitEthernet1/1", "application": "video", "expected_dscp": "cs0", "observed_dscp": "cs3", "vlan": 30, "description": "QoS misclassification on TenGigabitEthernet1/1: app=video, expected DSCP=cs0, observed DSCP=cs3 (VLAN 30)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "vlan": 30, "expected_dscp": "cs0", "observed_dscp": "cs3"}], "cli_fix": ["class-map match-any CM_CORER1_TenGi11", " match vlan 30", "policy-map PM_CORER1_TenGi11", " class CM_CORER1_TenGi11", "  set dscp cs0", "interface TenGigabitEthernet1/1", " service-policy input PM_CORER1_TenGi11", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T11:47:06.282411Z", "interface": "GigabitEthernet0/1", "application": "web", "expected_dscp": "af41", "observed_dscp": "ef", "vlan": 10, "description": "QoS misclassification on GigabitEthernet0/1: app=web, expected DSCP=af41, observed DSCP=ef (VLAN 10)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "vlan": 10, "expected_dscp": "af41", "observed_dscp": "ef"}], "cli_fix": ["class-map match-any CM_CORER1_Gi01", " match vlan 10", "policy-map PM_CORER1_Gi01", " class CM_CORER1_Gi01", "  set dscp af41", "interface GigabitEthernet0/1", " service-policy input PM_CORER1_Gi01", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T19:38:06.282612Z", "interface": "GigabitEthernet0/1", "application": "web", "expected_dscp": "af21", "observed_dscp": "ef", "vlan": 30, "description": "QoS misclassification on GigabitEthernet0/1: app=web, expected DSCP=af21, observed DSCP=ef (VLAN 30)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "vlan": 30, "expected_dscp": "af21", "observed_dscp": "ef"}], "cli_fix": ["class-map match-any CM_CORER1_Gi01", " match vlan 30", "policy-map PM_CORER1_Gi01", " class CM_CORER1_Gi01", "  set dscp af21", "interface GigabitEthernet0/1", " service-policy input PM_CORER1_Gi01", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T12:59:06.280135Z", "routing_process": "bgp", "pid": 4276, "stuck_minutes": 4, "symptom": "SPF calculation stuck", "description": "Routing process 'bgp' appears hung (pid=4276), stuck for ~4 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "routing_process": "bgp", "pid": 4276, "stuck_minutes": 4}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T19:36:06.281512Z", "routing_process": "bgp", "pid": 1896, "stuck_minutes": 44, "symptom": "Adjacency state not progressing", "description": "Routing process 'bgp' appears hung (pid=1896), stuck for ~44 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "routing_process": "bgp", "pid": 1896, "stuck_minutes": 44}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T13:34:06.280674Z", "routing_process": "isis", "pid": 958, "stuck_minutes": 13, "symptom": "SPF calculation stuck", "description": "Routing process 'isis' appears hung (pid=958), stuck for ~13 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios_xe", "routing_process": "isis", "pid": 958, "stuck_minutes": 13}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T18:21:06.279728Z", "routing_process": "isis", "pid": 3153, "stuck_minutes": 36, "symptom": "Adjacency state not progressing", "description": "Routing process 'isis' appears hung (pid=3153), stuck for ~36 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "routing_process": "isis", "pid": 3153, "stuck_minutes": 36}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T19:15:06.281667Z", "routing_process": "bgp", "pid": 570, "stuck_minutes": 24, "symptom": "SPF calculation stuck", "description": "Routing process 'bgp' appears hung (pid=570), stuck for ~24 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "routing_process": "bgp", "pid": 570, "stuck_minutes": 24}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T17:58:06.282425Z", "interface": "TenGigabitEthernet1/1", "application": "web", "expected_dscp": "cs3", "observed_dscp": "af31", "vlan": 20, "description": "QoS misclassification on TenGigabitEthernet1/1: app=web, expected DSCP=cs3, observed DSCP=af31 (VLAN 20)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "vlan": 20, "expected_dscp": "cs3", "observed_dscp": "af31"}], "cli_fix": ["class-map match-any CM_CORER2_TenGi11", " match vlan 20", "policy-map PM_CORER2_TenGi11", " class CM_CORER2_TenGi11", "  set dscp cs3", "interface TenGigabitEthernet1/1", " service-policy input PM_CORER2_TenGi11", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T20:54:06.287540Z", "interface": "GigabitEthernet0/1", "class": "VOICE", "drop_rate_pct": 40, "current_rate_kbps": 10000, "suggested_rate_kbps": 20000, "reason": "policer exceed drops", "description": "Policing drops on GigabitEthernet0/1 class=VOICE. Current rate 10000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "class": "VOICE", "current_rate_kbps": 10000, "suggested_rate_kbps": 20000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 20000 64000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T18:46:06.286112Z", "interface": "TenGigabitEthernet1/2", "class": "DATA", "drop_rate_pct": 39, "current_rate_kbps": 20000, "suggested_rate_kbps": 40000, "reason": "burst too small", "description": "Policing drops on TenGigabitEthernet1/2 class=DATA. Current rate 20000 kbps; drops due to burst too small."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "class": "DATA", "current_rate_kbps": 20000, "suggested_rate_kbps": 40000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 40000 8000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T13:04:06.285858Z", "interface": "GigabitEthernet0/1", "class": "VIDEO", "drop_rate_pct": 31, "current_rate_kbps": 5000, "suggested_rate_kbps": 15000, "reason": "policer exceed drops", "description": "Policing drops on GigabitEthernet0/1 class=VIDEO. Current rate 5000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "class": "VIDEO", "current_rate_kbps": 5000, "suggested_rate_kbps": 15000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 15000 32000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:24:06.281868Z", "interface": "GigabitEthernet0/1", "application": "video", "expected_dscp": "ef", "observed_dscp": "af21", "vlan": 50, "description": "QoS misclassification on GigabitEthernet0/1: app=video, expected DSCP=ef, observed DSCP=af21 (VLAN 50)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "vlan": 50, "expected_dscp": "ef", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi01", " match vlan 50", "policy-map PM_BRANCH_Gi01", " class CM_BRANCH_Gi01", "  set dscp ef", "interface GigabitEthernet0/1", " service-policy input PM_BRANCH_Gi01", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T13:43:06.283497Z", "interface": "GigabitEthernet1/0", "application": "backup", "expected_dscp": "af41", "observed_dscp": "af31", "vlan": 50, "description": "QoS misclassification on GigabitEthernet1/0: app=backup, expected DSCP=af41, observed DSCP=af31 (VLAN 50)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "vlan": 50, "expected_dscp": "af41", "observed_dscp": "af31"}], "cli_fix": ["class-map match-any CM_EDGERT_Gi10", " match vlan 50", "policy-map PM_EDGERT_Gi10", " class CM_EDGERT_Gi10", "  set dscp af41", "interface GigabitEthernet1/0", " service-policy input PM_EDGERT_Gi10", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:58:06.281643Z", "routing_process": "ospf", "pid": 385, "stuck_minutes": 21, "symptom": "Routing table not updating", "description": "Routing process 'ospf' appears hung (pid=385), stuck for ~21 minutes. Symptom: Routing table not updating."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "routing_process": "ospf", "pid": 385, "stuck_minutes": 21}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T20:33:06.284819Z", "interface": "GigabitEthernet0/0", "application": "backup", "expected_dscp": "af31", "observed_dscp": "af21", "vlan": 20, "description": "QoS misclassification on GigabitEthernet0/0: app=backup, expected DSCP=af31, observed DSCP=af21 (VLAN 20)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "vlan": 20, "expected_dscp": "af31", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_EDGERT_Gi00", " match vlan 20", "policy-map PM_EDGERT_Gi00", " class CM_EDGERT_Gi00", "  set dscp af31", "interface GigabitEthernet0/0", " service-policy input PM_EDGERT_Gi00", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T14:18:06.279749Z", "routing_process": "bgp", "pid": 2383, "stuck_minutes": 4, "symptom": "BGP scanner unresponsive", "description": "Routing process 'bgp' appears hung (pid=2383), stuck for ~4 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "routing_process": "bgp", "pid": 2383, "stuck_minutes": 4}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T11:41:06.282815Z", "interface": "GigabitEthernet0/0", "application": "backup", "expected_dscp": "af31", "observed_dscp": "af21", "vlan": 20, "description": "QoS misclassification on GigabitEthernet0/0: app=backup, expected DSCP=af31, observed DSCP=af21 (VLAN 20)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "vlan": 20, "expected_dscp": "af31", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_CORER1_Gi00", " match vlan 20", "policy-map PM_CORER1_Gi00", " class CM_CORER1_Gi00", "  set dscp af31", "interface GigabitEthernet0/0", " service-policy input PM_CORER1_Gi00", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T13:06:06.280012Z", "routing_process": "eigrp", "pid": 1484, "stuck_minutes": 32, "symptom": "BGP scanner unresponsive", "description": "Routing process 'eigrp' appears hung (pid=1484), stuck for ~32 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "routing_process": "eigrp", "pid": 1484, "stuck_minutes": 32}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T20:35:06.280623Z", "routing_process": "bgp", "pid": 414, "stuck_minutes": 9, "symptom": "BGP scanner unresponsive", "description": "Routing process 'bgp' appears hung (pid=414), stuck for ~9 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "routing_process": "bgp", "pid": 414, "stuck_minutes": 9}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T14:58:06.286755Z", "interface": "TenGigabitEthernet1/1", "class": "VIDEO", "drop_rate_pct": 17, "current_rate_kbps": 2000, "suggested_rate_kbps": 6000, "reason": "policer exceed drops", "description": "Policing drops on TenGigabitEthernet1/1 class=VIDEO. Current rate 2000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "class": "VIDEO", "current_rate_kbps": 2000, "suggested_rate_kbps": 6000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 6000 32000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T18:08:06.286011Z", "interface": "TenGigabitEthernet1/1", "class": "DATA", "drop_rate_pct": 18, "current_rate_kbps": 20000, "suggested_rate_kbps": 40000, "reason": "rate too low", "description": "Policing drops on TenGigabitEthernet1/1 class=DATA. Current rate 20000 kbps; drops due to rate too low."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "class": "DATA", "current_rate_kbps": 20000, "suggested_rate_kbps": 40000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 40000 8000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T18:42:06.283464Z", "interface": "GigabitEthernet1/0", "application": "voice", "expected_dscp": "ef", "observed_dscp": "cs0", "vlan": 50, "description": "QoS misclassification on GigabitEthernet1/0: app=voice, expected DSCP=ef, observed DSCP=cs0 (VLAN 50)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "vlan": 50, "expected_dscp": "ef", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi10", " match vlan 50", "policy-map PM_BRANCH_Gi10", " class CM_BRANCH_Gi10", "  set dscp ef", "interface GigabitEthernet1/0", " service-policy input PM_BRANCH_Gi10", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T17:32:06.287491Z", "interface": "GigabitEthernet0/0", "class": "VIDEO", "drop_rate_pct": 16, "current_rate_kbps": 2000, "suggested_rate_kbps": 4000, "reason": "token bucket depleted", "description": "Policing drops on GigabitEthernet0/0 class=VIDEO. Current rate 2000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "class": "VIDEO", "current_rate_kbps": 2000, "suggested_rate_kbps": 4000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 4000 32000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/0", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:47:06.283586Z", "interface": "GigabitEthernet0/0", "application": "backup", "expected_dscp": "af31", "observed_dscp": "cs0", "vlan": 20, "description": "QoS misclassification on GigabitEthernet0/0: app=backup, expected DSCP=af31, observed DSCP=cs0 (VLAN 20)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "vlan": 20, "expected_dscp": "af31", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_CORER2_Gi00", " match vlan 20", "policy-map PM_CORER2_Gi00", " class CM_CORER2_Gi00", "  set dscp af31", "interface GigabitEthernet0/0", " service-policy input PM_CORER2_Gi00", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T15:16:06.280216Z", "routing_process": "isis", "pid": 3405, "stuck_minutes": 32, "symptom": "RIB update stalled", "description": "Routing process 'isis' appears hung (pid=3405), stuck for ~32 minutes. Symptom: RIB update stalled."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "routing_process": "isis", "pid": 3405, "stuck_minutes": 32}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T20:56:06.281961Z", "interface": "GigabitEthernet0/0", "application": "backup", "expected_dscp": "ef", "observed_dscp": "af21", "vlan": 20, "description": "QoS misclassification on GigabitEthernet0/0: app=backup, expected DSCP=ef, observed DSCP=af21 (VLAN 20)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "vlan": 20, "expected_dscp": "ef", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_EDGERT_Gi00", " match vlan 20", "policy-map PM_EDGERT_Gi00", " class CM_EDGERT_Gi00", "  set dscp ef", "interface GigabitEthernet0/0", " service-policy input PM_EDGERT_Gi00", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T19:28:06.288189Z", "interface": "GigabitEthernet0/1", "class": "VIDEO", "drop_rate_pct": 15, "current_rate_kbps": 1000, "suggested_rate_kbps": 3000, "reason": "burst too small", "description": "Policing drops on GigabitEthernet0/1 class=VIDEO. Current rate 1000 kbps; drops due to burst too small."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "class": "VIDEO", "current_rate_kbps": 1000, "suggested_rate_kbps": 3000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 3000 32000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T18:24:06.282831Z", "interface": "TenGigabitEthernet1/1", "application": "erp", "expected_dscp": "af21", "observed_dscp": "ef", "vlan": 40, "description": "QoS misclassification on TenGigabitEthernet1/1: app=erp, expected DSCP=af21, observed DSCP=ef (VLAN 40)."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "vlan": 40, "expected_dscp": "af21", "observed_dscp": "ef"}], "cli_fix": ["class-map match-any CM_DCR2_TenGi11", " match vlan 40", "policy-map PM_DCR2_TenGi11", " class CM_DCR2_TenGi11", "  set dscp af21", "interface TenGigabitEthernet1/1", " service-policy input PM_DCR2_TenGi11", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T15:48:06.287377Z", "interface": "GigabitEthernet0/0", "class": "DATA", "drop_rate_pct": 35, "current_rate_kbps": 1000, "suggested_rate_kbps": 3000, "reason": "burst too small", "description": "Policing drops on GigabitEthernet0/0 class=DATA. Current rate 1000 kbps; drops due to burst too small."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "class": "DATA", "current_rate_kbps": 1000, "suggested_rate_kbps": 3000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 3000 32000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/0", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T15:09:06.280178Z", "routing_process": "ospf", "pid": 906, "stuck_minutes": 37, "symptom": "BGP scanner unresponsive", "description": "Routing process 'ospf' appears hung (pid=906), stuck for ~37 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "routing_process": "ospf", "pid": 906, "stuck_minutes": 37}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T18:50:06.280591Z", "routing_process": "eigrp", "pid": 3590, "stuck_minutes": 11, "symptom": "SPF calculation stuck", "description": "Routing process 'eigrp' appears hung (pid=3590), stuck for ~11 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "routing_process": "eigrp", "pid": 3590, "stuck_minutes": 11}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T14:46:06.281881Z", "interface": "TenGigabitEthernet1/1", "application": "video", "expected_dscp": "af41", "observed_dscp": "ef", "vlan": 20, "description": "QoS misclassification on TenGigabitEthernet1/1: app=video, expected DSCP=af41, observed DSCP=ef (VLAN 20)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "vlan": 20, "expected_dscp": "af41", "observed_dscp": "ef"}], "cli_fix": ["class-map match-any CM_CORER2_TenGi11", " match vlan 20", "policy-map PM_CORER2_TenGi11", " class CM_CORER2_TenGi11", "  set dscp af41", "interface TenGigabitEthernet1/1", " service-policy input PM_CORER2_TenGi11", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T19:53:06.279689Z", "routing_process": "ospf", "pid": 1872, "stuck_minutes": 19, "symptom": "SPF calculation stuck", "description": "Routing process 'ospf' appears hung (pid=1872), stuck for ~19 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "routing_process": "ospf", "pid": 1872, "stuck_minutes": 19}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T15:01:06.282356Z", "interface": "GigabitEthernet0/0", "application": "video", "expected_dscp": "ef", "observed_dscp": "af21", "vlan": 20, "description": "QoS misclassification on GigabitEthernet0/0: app=video, expected DSCP=ef, observed DSCP=af21 (VLAN 20)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "vlan": 20, "expected_dscp": "ef", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_EDGERT_Gi00", " match vlan 20", "policy-map PM_EDGERT_Gi00", " class CM_EDGERT_Gi00", "  set dscp ef", "interface GigabitEthernet0/0", " service-policy input PM_EDGERT_Gi00", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T21:19:06.287133Z", "interface": "GigabitEthernet0/1", "class": "VOICE", "drop_rate_pct": 35, "current_rate_kbps": 5000, "suggested_rate_kbps": 10000, "reason": "token bucket depleted", "description": "Policing drops on GigabitEthernet0/1 class=VOICE. Current rate 5000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "class": "VOICE", "current_rate_kbps": 5000, "suggested_rate_kbps": 10000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 10000 16000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T18:16:06.285906Z", "interface": "TenGigabitEthernet1/1", "class": "DATA", "drop_rate_pct": 24, "current_rate_kbps": 20000, "suggested_rate_kbps": 60000, "reason": "token bucket depleted", "description": "Policing drops on TenGigabitEthernet1/1 class=DATA. Current rate 20000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "class": "DATA", "current_rate_kbps": 20000, "suggested_rate_kbps": 60000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 60000 32000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T17:02:06.287212Z", "interface": "GigabitEthernet0/0", "class": "VIDEO", "drop_rate_pct": 12, "current_rate_kbps": 10000, "suggested_rate_kbps": 30000, "reason": "token bucket depleted", "description": "Policing drops on GigabitEthernet0/0 class=VIDEO. Current rate 10000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "class": "VIDEO", "current_rate_kbps": 10000, "suggested_rate_kbps": 30000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 30000 16000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/0", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T14:10:06.281052Z", "routing_process": "ospf", "pid": 109, "stuck_minutes": 40, "symptom": "RIB update stalled", "description": "Routing process 'ospf' appears hung (pid=109), stuck for ~40 minutes. Symptom: RIB update stalled."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "routing_process": "ospf", "pid": 109, "stuck_minutes": 40}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T16:33:06.285980Z", "interface": "TenGigabitEthernet1/1", "class": "VOICE", "drop_rate_pct": 5, "current_rate_kbps": 20000, "suggested_rate_kbps": 60000, "reason": "policer exceed drops", "description": "Policing drops on TenGigabitEthernet1/1 class=VOICE. Current rate 20000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "class": "VOICE", "current_rate_kbps": 20000, "suggested_rate_kbps": 60000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 60000 32000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T18:38:06.284565Z", "interface": "GigabitEthernet0/1", "application": "voice", "expected_dscp": "af41", "observed_dscp": "af21", "vlan": 50, "description": "QoS misclassification on GigabitEthernet0/1: app=voice, expected DSCP=af41, observed DSCP=af21 (VLAN 50)."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "vlan": 50, "expected_dscp": "af41", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_DCR1_Gi01", " match vlan 50", "policy-map PM_DCR1_Gi01", " class CM_DCR1_Gi01", "  set dscp af41", "interface GigabitEthernet0/1", " service-policy input PM_DCR1_Gi01", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T19:29:06.288197Z", "interface": "GigabitEthernet0/0", "class": "BULK", "drop_rate_pct": 17, "current_rate_kbps": 20000, "suggested_rate_kbps": 40000, "reason": "burst too small", "description": "Policing drops on GigabitEthernet0/0 class=BULK. Current rate 20000 kbps; drops due to burst too small."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "class": "BULK", "current_rate_kbps": 20000, "suggested_rate_kbps": 40000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 40000 32000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/0", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T16:10:06.281519Z", "routing_process": "isis", "pid": 3362, "stuck_minutes": 28, "symptom": "Adjacency state not progressing", "description": "Routing process 'isis' appears hung (pid=3362), stuck for ~28 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "routing_process": "isis", "pid": 3362, "stuck_minutes": 28}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T18:55:06.287953Z", "interface": "GigabitEthernet0/0", "class": "BULK", "drop_rate_pct": 16, "current_rate_kbps": 5000, "suggested_rate_kbps": 15000, "reason": "burst too small", "description": "Policing drops on GigabitEthernet0/0 class=BULK. Current rate 5000 kbps; drops due to burst too small."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "class": "BULK", "current_rate_kbps": 5000, "suggested_rate_kbps": 15000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 15000 16000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/0", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T13:08:06.281254Z", "routing_process": "eigrp", "pid": 431, "stuck_minutes": 36, "symptom": "SPF calculation stuck", "description": "Routing process 'eigrp' appears hung (pid=431), stuck for ~36 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "routing_process": "eigrp", "pid": 431, "stuck_minutes": 36}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T15:32:06.280578Z", "routing_process": "eigrp", "pid": 4938, "stuck_minutes": 24, "symptom": "Adjacency state not progressing", "description": "Routing process 'eigrp' appears hung (pid=4938), stuck for ~24 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios", "routing_process": "eigrp", "pid": 4938, "stuck_minutes": 24}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T13:13:06.285578Z", "interface": "GigabitEthernet1/0", "class": "VIDEO", "drop_rate_pct": 21, "current_rate_kbps": 1000, "suggested_rate_kbps": 2000, "reason": "token bucket depleted", "description": "Policing drops on GigabitEthernet1/0 class=VIDEO. Current rate 1000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "class": "VIDEO", "current_rate_kbps": 1000, "suggested_rate_kbps": 2000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 2000 64000 conform-action transmit exceed-action drop", "interface GigabitEthernet1/0", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T12:44:06.281949Z", "interface": "GigabitEthernet0/0", "application": "voice", "expected_dscp": "cs0", "observed_dscp": "cs3", "vlan": 50, "description": "QoS misclassification on GigabitEthernet0/0: app=voice, expected DSCP=cs0, observed DSCP=cs3 (VLAN 50)."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "vlan": 50, "expected_dscp": "cs0", "observed_dscp": "cs3"}], "cli_fix": ["class-map match-any CM_DCR1_Gi00", " match vlan 50", "policy-map PM_DCR1_Gi00", " class CM_DCR1_Gi00", "  set dscp cs0", "interface GigabitEthernet0/0", " service-policy input PM_DCR1_Gi00", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T15:07:06.280714Z", "routing_process": "ospf", "pid": 825, "stuck_minutes": 13, "symptom": "Routing table not updating", "description": "Routing process 'ospf' appears hung (pid=825), stuck for ~13 minutes. Symptom: Routing table not updating."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "routing_process": "ospf", "pid": 825, "stuck_minutes": 13}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T12:12:06.285550Z", "interface": "TenGigabitEthernet1/1", "class": "BULK", "drop_rate_pct": 15, "current_rate_kbps": 10000, "suggested_rate_kbps": 30000, "reason": "token bucket depleted", "description": "Policing drops on TenGigabitEthernet1/1 class=BULK. Current rate 10000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "class": "BULK", "current_rate_kbps": 10000, "suggested_rate_kbps": 30000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 30000 8000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T16:28:06.288109Z", "interface": "TenGigabitEthernet1/1", "class": "DATA", "drop_rate_pct": 19, "current_rate_kbps": 2000, "suggested_rate_kbps": 4000, "reason": "policer exceed drops", "description": "Policing drops on TenGigabitEthernet1/1 class=DATA. Current rate 2000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "class": "DATA", "current_rate_kbps": 2000, "suggested_rate_kbps": 4000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 4000 32000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T13:03:06.283313Z", "interface": "GigabitEthernet0/1", "application": "video", "expected_dscp": "cs3", "observed_dscp": "af41", "vlan": 30, "description": "QoS misclassification on GigabitEthernet0/1: app=video, expected DSCP=cs3, observed DSCP=af41 (VLAN 30)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "vlan": 30, "expected_dscp": "cs3", "observed_dscp": "af41"}], "cli_fix": ["class-map match-any CM_CORER2_Gi01", " match vlan 30", "policy-map PM_CORER2_Gi01", " class CM_CORER2_Gi01", "  set dscp cs3", "interface GigabitEthernet0/1", " service-policy input PM_CORER2_Gi01", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T21:04:06.282883Z", "interface": "GigabitEthernet0/1", "application": "voice", "expected_dscp": "ef", "observed_dscp": "af41", "vlan": 20, "description": "QoS misclassification on GigabitEthernet0/1: app=voice, expected DSCP=ef, observed DSCP=af41 (VLAN 20)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "vlan": 20, "expected_dscp": "ef", "observed_dscp": "af41"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi01", " match vlan 20", "policy-map PM_BRANCH_Gi01", " class CM_BRANCH_Gi01", "  set dscp ef", "interface GigabitEthernet0/1", " service-policy input PM_BRANCH_Gi01", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T18:38:06.282746Z", "interface": "GigabitEthernet1/0", "application": "web", "expected_dscp": "af21", "observed_dscp": "af31", "vlan": 50, "description": "QoS misclassification on GigabitEthernet1/0: app=web, expected DSCP=af21, observed DSCP=af31 (VLAN 50)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "vlan": 50, "expected_dscp": "af21", "observed_dscp": "af31"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi10", " match vlan 50", "policy-map PM_BRANCH_Gi10", " class CM_BRANCH_Gi10", "  set dscp af21", "interface GigabitEthernet1/0", " service-policy input PM_BRANCH_Gi10", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T21:01:06.281235Z", "routing_process": "eigrp", "pid": 2783, "stuck_minutes": 27, "symptom": "RIB update stalled", "description": "Routing process 'eigrp' appears hung (pid=2783), stuck for ~27 minutes. Symptom: RIB update stalled."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "routing_process": "eigrp", "pid": 2783, "stuck_minutes": 27}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T21:21:06.280172Z", "routing_process": "isis", "pid": 976, "stuck_minutes": 29, "symptom": "RIB update stalled", "description": "Routing process 'isis' appears hung (pid=976), stuck for ~29 minutes. Symptom: RIB update stalled."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios", "routing_process": "isis", "pid": 976, "stuck_minutes": 29}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T13:48:06.281190Z", "routing_process": "isis", "pid": 489, "stuck_minutes": 20, "symptom": "Adjacency state not progressing", "description": "Routing process 'isis' appears hung (pid=489), stuck for ~20 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "routing_process": "isis", "pid": 489, "stuck_minutes": 20}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T18:54:06.280203Z", "routing_process": "eigrp", "pid": 4019, "stuck_minutes": 20, "symptom": "SPF calculation stuck", "description": "Routing process 'eigrp' appears hung (pid=4019), stuck for ~20 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "routing_process": "eigrp", "pid": 4019, "stuck_minutes": 20}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T17:41:06.288035Z", "interface": "TenGigabitEthernet1/1", "class": "VOICE", "drop_rate_pct": 13, "current_rate_kbps": 2000, "suggested_rate_kbps": 4000, "reason": "burst too small", "description": "Policing drops on TenGigabitEthernet1/1 class=VOICE. Current rate 2000 kbps; drops due to burst too small."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "class": "VOICE", "current_rate_kbps": 2000, "suggested_rate_kbps": 4000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 4000 16000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:56:06.281367Z", "routing_process": "ospf", "pid": 412, "stuck_minutes": 30, "symptom": "BGP scanner unresponsive", "description": "Routing process 'ospf' appears hung (pid=412), stuck for ~30 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "routing_process": "ospf", "pid": 412, "stuck_minutes": 30}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:18:06.286696Z", "interface": "TenGigabitEthernet1/1", "class": "DATA", "drop_rate_pct": 11, "current_rate_kbps": 20000, "suggested_rate_kbps": 60000, "reason": "burst too small", "description": "Policing drops on TenGigabitEthernet1/1 class=DATA. Current rate 20000 kbps; drops due to burst too small."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "class": "DATA", "current_rate_kbps": 20000, "suggested_rate_kbps": 60000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 60000 64000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T15:10:06.284714Z", "interface": "GigabitEthernet0/1", "application": "erp", "expected_dscp": "af31", "observed_dscp": "cs0", "vlan": 50, "description": "QoS misclassification on GigabitEthernet0/1: app=erp, expected DSCP=af31, observed DSCP=cs0 (VLAN 50)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "vlan": 50, "expected_dscp": "af31", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_CORER1_Gi01", " match vlan 50", "policy-map PM_CORER1_Gi01", " class CM_CORER1_Gi01", "  set dscp af31", "interface GigabitEthernet0/1", " service-policy input PM_CORER1_Gi01", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T13:36:06.281103Z", "routing_process": "isis", "pid": 4142, "stuck_minutes": 20, "symptom": "RIB update stalled", "description": "Routing process 'isis' appears hung (pid=4142), stuck for ~20 minutes. Symptom: RIB update stalled."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios", "routing_process": "isis", "pid": 4142, "stuck_minutes": 20}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T19:40:06.283228Z", "interface": "GigabitEthernet0/0", "application": "voice", "expected_dscp": "af21", "observed_dscp": "cs3", "vlan": 40, "description": "QoS misclassification on GigabitEthernet0/0: app=voice, expected DSCP=af21, observed DSCP=cs3 (VLAN 40)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "vlan": 40, "expected_dscp": "af21", "observed_dscp": "cs3"}], "cli_fix": ["class-map match-any CM_EDGERT_Gi00", " match vlan 40", "policy-map PM_EDGERT_Gi00", " class CM_EDGERT_Gi00", "  set dscp af21", "interface GigabitEthernet0/0", " service-policy input PM_EDGERT_Gi00", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T19:31:06.286764Z", "interface": "GigabitEthernet0/0", "class": "VOICE", "drop_rate_pct": 7, "current_rate_kbps": 2000, "suggested_rate_kbps": 4000, "reason": "token bucket depleted", "description": "Policing drops on GigabitEthernet0/0 class=VOICE. Current rate 2000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "class": "VOICE", "current_rate_kbps": 2000, "suggested_rate_kbps": 4000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 4000 16000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/0", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T12:56:06.282301Z", "interface": "TenGigabitEthernet1/1", "application": "web", "expected_dscp": "ef", "observed_dscp": "cs3", "vlan": 20, "description": "QoS misclassification on TenGigabitEthernet1/1: app=web, expected DSCP=ef, observed DSCP=cs3 (VLAN 20)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "vlan": 20, "expected_dscp": "ef", "observed_dscp": "cs3"}], "cli_fix": ["class-map match-any CM_BRANCH_TenGi11", " match vlan 20", "policy-map PM_BRANCH_TenGi11", " class CM_BRANCH_TenGi11", "  set dscp ef", "interface TenGigabitEthernet1/1", " service-policy input PM_BRANCH_TenGi11", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T13:49:06.279707Z", "routing_process": "ospf", "pid": 4142, "stuck_minutes": 7, "symptom": "RIB update stalled", "description": "Routing process 'ospf' appears hung (pid=4142), stuck for ~7 minutes. Symptom: RIB update stalled."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios", "routing_process": "ospf", "pid": 4142, "stuck_minutes": 7}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T21:21:06.286569Z", "interface": "TenGigabitEthernet1/1", "class": "VIDEO", "drop_rate_pct": 36, "current_rate_kbps": 10000, "suggested_rate_kbps": 30000, "reason": "token bucket depleted", "description": "Policing drops on TenGigabitEthernet1/1 class=VIDEO. Current rate 10000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "class": "VIDEO", "current_rate_kbps": 10000, "suggested_rate_kbps": 30000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 30000 8000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:40:06.279714Z", "routing_process": "bgp", "pid": 1313, "stuck_minutes": 17, "symptom": "SPF calculation stuck", "description": "Routing process 'bgp' appears hung (pid=1313), stuck for ~17 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "routing_process": "bgp", "pid": 1313, "stuck_minutes": 17}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T17:40:06.284237Z", "interface": "TenGigabitEthernet1/1", "application": "video", "expected_dscp": "ef", "observed_dscp": "af31", "vlan": 10, "description": "QoS misclassification on TenGigabitEthernet1/1: app=video, expected DSCP=ef, observed DSCP=af31 (VLAN 10)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "vlan": 10, "expected_dscp": "ef", "observed_dscp": "af31"}], "cli_fix": ["class-map match-any CM_EDGERT_TenGi11", " match vlan 10", "policy-map PM_EDGERT_TenGi11", " class CM_EDGERT_TenGi11", "  set dscp ef", "interface TenGigabitEthernet1/1", " service-policy input PM_EDGERT_TenGi11", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T17:08:06.281568Z", "routing_process": "isis", "pid": 2159, "stuck_minutes": 18, "symptom": "Adjacency state not progressing", "description": "Routing process 'isis' appears hung (pid=2159), stuck for ~18 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "routing_process": "isis", "pid": 2159, "stuck_minutes": 18}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T12:29:06.282719Z", "interface": "GigabitEthernet0/1", "application": "web", "expected_dscp": "af41", "observed_dscp": "ef", "vlan": 40, "description": "QoS misclassification on GigabitEthernet0/1: app=web, expected DSCP=af41, observed DSCP=ef (VLAN 40)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "vlan": 40, "expected_dscp": "af41", "observed_dscp": "ef"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi01", " match vlan 40", "policy-map PM_BRANCH_Gi01", " class CM_BRANCH_Gi01", "  set dscp af41", "interface GigabitEthernet0/1", " service-policy input PM_BRANCH_Gi01", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T13:17:06.283346Z", "interface": "GigabitEthernet0/0", "application": "voice", "expected_dscp": "af21", "observed_dscp": "cs3", "vlan": 10, "description": "QoS misclassification on GigabitEthernet0/0: app=voice, expected DSCP=af21, observed DSCP=cs3 (VLAN 10)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "vlan": 10, "expected_dscp": "af21", "observed_dscp": "cs3"}], "cli_fix": ["class-map match-any CM_EDGERT_Gi00", " match vlan 10", "policy-map PM_EDGERT_Gi00", " class CM_EDGERT_Gi00", "  set dscp af21", "interface GigabitEthernet0/0", " service-policy input PM_EDGERT_Gi00", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T14:25:06.281196Z", "routing_process": "bgp", "pid": 4665, "stuck_minutes": 38, "symptom": "RIB update stalled", "description": "Routing process 'bgp' appears hung (pid=4665), stuck for ~38 minutes. Symptom: RIB update stalled."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "routing_process": "bgp", "pid": 4665, "stuck_minutes": 38}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:30:06.284858Z", "interface": "GigabitEthernet0/0", "application": "video", "expected_dscp": "cs0", "observed_dscp": "ef", "vlan": 10, "description": "QoS misclassification on GigabitEthernet0/0: app=video, expected DSCP=cs0, observed DSCP=ef (VLAN 10)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "vlan": 10, "expected_dscp": "cs0", "observed_dscp": "ef"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi00", " match vlan 10", "policy-map PM_BRANCH_Gi00", " class CM_BRANCH_Gi00", "  set dscp cs0", "interface GigabitEthernet0/0", " service-policy input PM_BRANCH_Gi00", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T19:48:06.283779Z", "interface": "TenGigabitEthernet1/2", "application": "video", "expected_dscp": "cs3", "observed_dscp": "ef", "vlan": 10, "description": "QoS misclassification on TenGigabitEthernet1/2: app=video, expected DSCP=cs3, observed DSCP=ef (VLAN 10)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "vlan": 10, "expected_dscp": "cs3", "observed_dscp": "ef"}], "cli_fix": ["class-map match-any CM_EDGERT_TenGi12", " match vlan 10", "policy-map PM_EDGERT_TenGi12", " class CM_EDGERT_TenGi12", "  set dscp cs3", "interface TenGigabitEthernet1/2", " service-policy input PM_EDGERT_TenGi12", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T13:27:06.284052Z", "interface": "TenGigabitEthernet1/2", "application": "erp", "expected_dscp": "af21", "observed_dscp": "af31", "vlan": 20, "description": "QoS misclassification on TenGigabitEthernet1/2: app=erp, expected DSCP=af21, observed DSCP=af31 (VLAN 20)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "vlan": 20, "expected_dscp": "af21", "observed_dscp": "af31"}], "cli_fix": ["class-map match-any CM_EDGERT_TenGi12", " match vlan 20", "policy-map PM_EDGERT_TenGi12", " class CM_EDGERT_TenGi12", "  set dscp af21", "interface TenGigabitEthernet1/2", " service-policy input PM_EDGERT_TenGi12", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T19:45:06.286949Z", "interface": "GigabitEthernet0/1", "class": "BULK", "drop_rate_pct": 21, "current_rate_kbps": 20000, "suggested_rate_kbps": 60000, "reason": "token bucket depleted", "description": "Policing drops on GigabitEthernet0/1 class=BULK. Current rate 20000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "class": "BULK", "current_rate_kbps": 20000, "suggested_rate_kbps": 60000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 60000 64000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T15:31:06.288324Z", "interface": "TenGigabitEthernet1/2", "class": "BULK", "drop_rate_pct": 9, "current_rate_kbps": 20000, "suggested_rate_kbps": 40000, "reason": "rate too low", "description": "Policing drops on TenGigabitEthernet1/2 class=BULK. Current rate 20000 kbps; drops due to rate too low."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "class": "BULK", "current_rate_kbps": 20000, "suggested_rate_kbps": 40000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 40000 8000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T13:53:06.280025Z", "routing_process": "bgp", "pid": 3996, "stuck_minutes": 33, "symptom": "Routing table not updating", "description": "Routing process 'bgp' appears hung (pid=3996), stuck for ~33 minutes. Symptom: Routing table not updating."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios_xe", "routing_process": "bgp", "pid": 3996, "stuck_minutes": 33}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T15:06:06.280733Z", "routing_process": "eigrp", "pid": 4936, "stuck_minutes": 4, "symptom": "SPF calculation stuck", "description": "Routing process 'eigrp' appears hung (pid=4936), stuck for ~4 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "routing_process": "eigrp", "pid": 4936, "stuck_minutes": 4}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T17:45:06.285506Z", "interface": "GigabitEthernet0/1", "class": "BULK", "drop_rate_pct": 18, "current_rate_kbps": 5000, "suggested_rate_kbps": 10000, "reason": "policer exceed drops", "description": "Policing drops on GigabitEthernet0/1 class=BULK. Current rate 5000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "class": "BULK", "current_rate_kbps": 5000, "suggested_rate_kbps": 10000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 10000 32000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T12:11:06.284974Z", "interface": "GigabitEthernet0/0", "application": "backup", "expected_dscp": "ef", "observed_dscp": "af21", "vlan": 10, "description": "QoS misclassification on GigabitEthernet0/0: app=backup, expected DSCP=ef, observed DSCP=af21 (VLAN 10)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "vlan": 10, "expected_dscp": "ef", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_EDGERT_Gi00", " match vlan 10", "policy-map PM_EDGERT_Gi00", " class CM_EDGERT_Gi00", "  set dscp ef", "interface GigabitEthernet0/0", " service-policy input PM_EDGERT_Gi00", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T18:08:06.287713Z", "interface": "TenGigabitEthernet1/2", "class": "DATA", "drop_rate_pct": 32, "current_rate_kbps": 10000, "suggested_rate_kbps": 20000, "reason": "token bucket depleted", "description": "Policing drops on TenGigabitEthernet1/2 class=DATA. Current rate 10000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/2", "class": "DATA", "current_rate_kbps": 10000, "suggested_rate_kbps": 20000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 20000 8000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T20:04:06.279762Z", "routing_process": "isis", "pid": 3492, "stuck_minutes": 13, "symptom": "RIB update stalled", "description": "Routing process 'isis' appears hung (pid=3492), stuck for ~13 minutes. Symptom: RIB update stalled."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "routing_process": "isis", "pid": 3492, "stuck_minutes": 13}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T17:49:06.280006Z", "routing_process": "ospf", "pid": 573, "stuck_minutes": 40, "symptom": "Routing table not updating", "description": "Routing process 'ospf' appears hung (pid=573), stuck for ~40 minutes. Symptom: Routing table not updating."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "routing_process": "ospf", "pid": 573, "stuck_minutes": 40}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T14:43:06.279699Z", "routing_process": "isis", "pid": 989, "stuck_minutes": 4, "symptom": "RIB update stalled", "description": "Routing process 'isis' appears hung (pid=989), stuck for ~4 minutes. Symptom: RIB update stalled."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "routing_process": "isis", "pid": 989, "stuck_minutes": 4}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T17:34:06.280553Z", "routing_process": "isis", "pid": 3751, "stuck_minutes": 26, "symptom": "BGP scanner unresponsive", "description": "Routing process 'isis' appears hung (pid=3751), stuck for ~26 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "routing_process": "isis", "pid": 3751, "stuck_minutes": 26}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T21:23:06.280547Z", "routing_process": "bgp", "pid": 1521, "stuck_minutes": 38, "symptom": "Adjacency state not progressing", "description": "Routing process 'bgp' appears hung (pid=1521), stuck for ~38 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "routing_process": "bgp", "pid": 1521, "stuck_minutes": 38}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T19:59:06.283403Z", "interface": "GigabitEthernet1/0", "application": "erp", "expected_dscp": "af31", "observed_dscp": "cs3", "vlan": 20, "description": "QoS misclassification on GigabitEthernet1/0: app=erp, expected DSCP=af31, observed DSCP=cs3 (VLAN 20)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "vlan": 20, "expected_dscp": "af31", "observed_dscp": "cs3"}], "cli_fix": ["class-map match-any CM_CORER2_Gi10", " match vlan 20", "policy-map PM_CORER2_Gi10", " class CM_CORER2_Gi10", "  set dscp af31", "interface GigabitEthernet1/0", " service-policy input PM_CORER2_Gi10", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T20:06:06.280995Z", "routing_process": "isis", "pid": 2531, "stuck_minutes": 27, "symptom": "SPF calculation stuck", "description": "Routing process 'isis' appears hung (pid=2531), stuck for ~27 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "routing_process": "isis", "pid": 2531, "stuck_minutes": 27}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T16:07:06.280355Z", "routing_process": "eigrp", "pid": 2474, "stuck_minutes": 22, "symptom": "SPF calculation stuck", "description": "Routing process 'eigrp' appears hung (pid=2474), stuck for ~22 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "routing_process": "eigrp", "pid": 2474, "stuck_minutes": 22}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T20:05:06.282398Z", "interface": "GigabitEthernet0/1", "application": "voice", "expected_dscp": "ef", "observed_dscp": "cs3", "vlan": 10, "description": "QoS misclassification on GigabitEthernet0/1: app=voice, expected DSCP=ef, observed DSCP=cs3 (VLAN 10)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "vlan": 10, "expected_dscp": "ef", "observed_dscp": "cs3"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi01", " match vlan 10", "policy-map PM_BRANCH_Gi01", " class CM_BRANCH_Gi01", "  set dscp ef", "interface GigabitEthernet0/1", " service-policy input PM_BRANCH_Gi01", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T12:32:06.288144Z", "interface": "GigabitEthernet0/0", "class": "BULK", "drop_rate_pct": 38, "current_rate_kbps": 5000, "suggested_rate_kbps": 10000, "reason": "burst too small", "description": "Policing drops on GigabitEthernet0/0 class=BULK. Current rate 5000 kbps; drops due to burst too small."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "class": "BULK", "current_rate_kbps": 5000, "suggested_rate_kbps": 10000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 10000 64000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/0", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T17:04:06.283969Z", "interface": "GigabitEthernet1/0", "application": "web", "expected_dscp": "af41", "observed_dscp": "af21", "vlan": 30, "description": "QoS misclassification on GigabitEthernet1/0: app=web, expected DSCP=af41, observed DSCP=af21 (VLAN 30)."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "vlan": 30, "expected_dscp": "af41", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_DCR2_Gi10", " match vlan 30", "policy-map PM_DCR2_Gi10", " class CM_DCR2_Gi10", "  set dscp af41", "interface GigabitEthernet1/0", " service-policy input PM_DCR2_Gi10", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T17:37:06.284064Z", "interface": "GigabitEthernet0/0", "application": "voice", "expected_dscp": "ef", "observed_dscp": "af41", "vlan": 20, "description": "QoS misclassification on GigabitEthernet0/0: app=voice, expected DSCP=ef, observed DSCP=af41 (VLAN 20)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "vlan": 20, "expected_dscp": "ef", "observed_dscp": "af41"}], "cli_fix": ["class-map match-any CM_EDGERT_Gi00", " match vlan 20", "policy-map PM_EDGERT_Gi00", " class CM_EDGERT_Gi00", "  set dscp ef", "interface GigabitEthernet0/0", " service-policy input PM_EDGERT_Gi00", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T19:01:06.281680Z", "routing_process": "eigrp", "pid": 1465, "stuck_minutes": 35, "symptom": "Routing table not updating", "description": "Routing process 'eigrp' appears hung (pid=1465), stuck for ~35 minutes. Symptom: Routing table not updating."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "routing_process": "eigrp", "pid": 1465, "stuck_minutes": 35}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T21:04:06.286962Z", "interface": "GigabitEthernet0/1", "class": "BULK", "drop_rate_pct": 27, "current_rate_kbps": 5000, "suggested_rate_kbps": 10000, "reason": "burst too small", "description": "Policing drops on GigabitEthernet0/1 class=BULK. Current rate 5000 kbps; drops due to burst too small."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "class": "BULK", "current_rate_kbps": 5000, "suggested_rate_kbps": 10000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 10000 8000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T14:27:06.287600Z", "interface": "TenGigabitEthernet1/1", "class": "VOICE", "drop_rate_pct": 5, "current_rate_kbps": 20000, "suggested_rate_kbps": 40000, "reason": "burst too small", "description": "Policing drops on TenGigabitEthernet1/1 class=VOICE. Current rate 20000 kbps; drops due to burst too small."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "class": "VOICE", "current_rate_kbps": 20000, "suggested_rate_kbps": 40000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 40000 64000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T12:04:06.281562Z", "routing_process": "bgp", "pid": 2011, "stuck_minutes": 22, "symptom": "SPF calculation stuck", "description": "Routing process 'bgp' appears hung (pid=2011), stuck for ~22 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "routing_process": "bgp", "pid": 2011, "stuck_minutes": 22}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T21:13:06.285119Z", "interface": "TenGigabitEthernet1/1", "application": "backup", "expected_dscp": "cs3", "observed_dscp": "af21", "vlan": 20, "description": "QoS misclassification on TenGigabitEthernet1/1: app=backup, expected DSCP=cs3, observed DSCP=af21 (VLAN 20)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "vlan": 20, "expected_dscp": "cs3", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_BRANCH_TenGi11", " match vlan 20", "policy-map PM_BRANCH_TenGi11", " class CM_BRANCH_TenGi11", "  set dscp cs3", "interface TenGigabitEthernet1/1", " service-policy input PM_BRANCH_TenGi11", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T18:49:06.284324Z", "interface": "TenGigabitEthernet1/1", "application": "voice", "expected_dscp": "cs3", "observed_dscp": "cs0", "vlan": 10, "description": "QoS misclassification on TenGigabitEthernet1/1: app=voice, expected DSCP=cs3, observed DSCP=cs0 (VLAN 10)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "vlan": 10, "expected_dscp": "cs3", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_EDGERT_TenGi11", " match vlan 10", "policy-map PM_EDGERT_TenGi11", " class CM_EDGERT_TenGi11", "  set dscp cs3", "interface TenGigabitEthernet1/1", " service-policy input PM_EDGERT_TenGi11", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T13:28:06.280388Z", "routing_process": "eigrp", "pid": 540, "stuck_minutes": 10, "symptom": "SPF calculation stuck", "description": "Routing process 'eigrp' appears hung (pid=540), stuck for ~10 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "routing_process": "eigrp", "pid": 540, "stuck_minutes": 10}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T12:24:06.279970Z", "routing_process": "eigrp", "pid": 874, "stuck_minutes": 21, "symptom": "SPF calculation stuck", "description": "Routing process 'eigrp' appears hung (pid=874), stuck for ~21 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "routing_process": "eigrp", "pid": 874, "stuck_minutes": 21}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T13:29:06.281091Z", "routing_process": "ospf", "pid": 1294, "stuck_minutes": 36, "symptom": "Adjacency state not progressing", "description": "Routing process 'ospf' appears hung (pid=1294), stuck for ~36 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "routing_process": "ospf", "pid": 1294, "stuck_minutes": 36}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T13:40:06.282915Z", "interface": "GigabitEthernet0/1", "application": "video", "expected_dscp": "cs3", "observed_dscp": "af21", "vlan": 30, "description": "QoS misclassification on GigabitEthernet0/1: app=video, expected DSCP=cs3, observed DSCP=af21 (VLAN 30)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "vlan": 30, "expected_dscp": "cs3", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_EDGERT_Gi01", " match vlan 30", "policy-map PM_EDGERT_Gi01", " class CM_EDGERT_Gi01", "  set dscp cs3", "interface GigabitEthernet0/1", " service-policy input PM_EDGERT_Gi01", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T20:02:06.281392Z", "routing_process": "bgp", "pid": 1507, "stuck_minutes": 34, "symptom": "RIB update stalled", "description": "Routing process 'bgp' appears hung (pid=1507), stuck for ~34 minutes. Symptom: RIB update stalled."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "routing_process": "bgp", "pid": 1507, "stuck_minutes": 34}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T14:56:06.286462Z", "interface": "GigabitEthernet1/0", "class": "DATA", "drop_rate_pct": 20, "current_rate_kbps": 2000, "suggested_rate_kbps": 4000, "reason": "token bucket depleted", "description": "Policing drops on GigabitEthernet1/0 class=DATA. Current rate 2000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "class": "DATA", "current_rate_kbps": 2000, "suggested_rate_kbps": 4000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 4000 64000 conform-action transmit exceed-action drop", "interface GigabitEthernet1/0", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T18:23:06.280803Z", "routing_process": "eigrp", "pid": 1102, "stuck_minutes": 23, "symptom": "Routing table not updating", "description": "Routing process 'eigrp' appears hung (pid=1102), stuck for ~23 minutes. Symptom: Routing table not updating."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "routing_process": "eigrp", "pid": 1102, "stuck_minutes": 23}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T19:45:06.283085Z", "interface": "TenGigabitEthernet1/2", "application": "web", "expected_dscp": "af41", "observed_dscp": "ef", "vlan": 20, "description": "QoS misclassification on TenGigabitEthernet1/2: app=web, expected DSCP=af41, observed DSCP=ef (VLAN 20)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "vlan": 20, "expected_dscp": "af41", "observed_dscp": "ef"}], "cli_fix": ["class-map match-any CM_CORER1_TenGi12", " match vlan 20", "policy-map PM_CORER1_TenGi12", " class CM_CORER1_TenGi12", "  set dscp af41", "interface TenGigabitEthernet1/2", " service-policy input PM_CORER1_TenGi12", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T12:41:06.284257Z", "interface": "GigabitEthernet0/1", "application": "voice", "expected_dscp": "af41", "observed_dscp": "ef", "vlan": 20, "description": "QoS misclassification on GigabitEthernet0/1: app=voice, expected DSCP=af41, observed DSCP=ef (VLAN 20)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "vlan": 20, "expected_dscp": "af41", "observed_dscp": "ef"}], "cli_fix": ["class-map match-any CM_CORER1_Gi01", " match vlan 20", "policy-map PM_CORER1_Gi01", " class CM_CORER1_Gi01", "  set dscp af41", "interface GigabitEthernet0/1", " service-policy input PM_CORER1_Gi01", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T19:17:06.285109Z", "interface": "TenGigabitEthernet1/2", "application": "voice", "expected_dscp": "cs0", "observed_dscp": "af31", "vlan": 40, "description": "QoS misclassification on TenGigabitEthernet1/2: app=voice, expected DSCP=cs0, observed DSCP=af31 (VLAN 40)."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/2", "vlan": 40, "expected_dscp": "cs0", "observed_dscp": "af31"}], "cli_fix": ["class-map match-any CM_DCR2_TenGi12", " match vlan 40", "policy-map PM_DCR2_TenGi12", " class CM_DCR2_TenGi12", "  set dscp cs0", "interface TenGigabitEthernet1/2", " service-policy input PM_DCR2_TenGi12", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T18:02:06.283042Z", "interface": "GigabitEthernet1/0", "application": "web", "expected_dscp": "cs3", "observed_dscp": "af41", "vlan": 20, "description": "QoS misclassification on GigabitEthernet1/0: app=web, expected DSCP=cs3, observed DSCP=af41 (VLAN 20)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "vlan": 20, "expected_dscp": "cs3", "observed_dscp": "af41"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi10", " match vlan 20", "policy-map PM_BRANCH_Gi10", " class CM_BRANCH_Gi10", "  set dscp cs3", "interface GigabitEthernet1/0", " service-policy input PM_BRANCH_Gi10", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T13:58:06.282444Z", "interface": "GigabitEthernet1/0", "application": "video", "expected_dscp": "cs3", "observed_dscp": "af31", "vlan": 50, "description": "QoS misclassification on GigabitEthernet1/0: app=video, expected DSCP=cs3, observed DSCP=af31 (VLAN 50)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "vlan": 50, "expected_dscp": "cs3", "observed_dscp": "af31"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi10", " match vlan 50", "policy-map PM_BRANCH_Gi10", " class CM_BRANCH_Gi10", "  set dscp cs3", "interface GigabitEthernet1/0", " service-policy input PM_BRANCH_Gi10", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T18:51:06.283621Z", "interface": "TenGigabitEthernet1/1", "application": "video", "expected_dscp": "cs0", "observed_dscp": "af31", "vlan": 50, "description": "QoS misclassification on TenGigabitEthernet1/1: app=video, expected DSCP=cs0, observed DSCP=af31 (VLAN 50)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "vlan": 50, "expected_dscp": "cs0", "observed_dscp": "af31"}], "cli_fix": ["class-map match-any CM_CORER2_TenGi11", " match vlan 50", "policy-map PM_CORER2_TenGi11", " class CM_CORER2_TenGi11", "  set dscp cs0", "interface TenGigabitEthernet1/1", " service-policy input PM_CORER2_TenGi11", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T15:37:06.286828Z", "interface": "GigabitEthernet0/0", "class": "BULK", "drop_rate_pct": 28, "current_rate_kbps": 10000, "suggested_rate_kbps": 30000, "reason": "token bucket depleted", "description": "Policing drops on GigabitEthernet0/0 class=BULK. Current rate 10000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "class": "BULK", "current_rate_kbps": 10000, "suggested_rate_kbps": 30000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 30000 16000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/0", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T14:24:06.280784Z", "routing_process": "isis", "pid": 3626, "stuck_minutes": 12, "symptom": "BGP scanner unresponsive", "description": "Routing process 'isis' appears hung (pid=3626), stuck for ~12 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "routing_process": "isis", "pid": 3626, "stuck_minutes": 12}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T14:07:06.283837Z", "interface": "GigabitEthernet1/0", "application": "erp", "expected_dscp": "cs0", "observed_dscp": "af21", "vlan": 50, "description": "QoS misclassification on GigabitEthernet1/0: app=erp, expected DSCP=cs0, observed DSCP=af21 (VLAN 50)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "vlan": 50, "expected_dscp": "cs0", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_EDGERT_Gi10", " match vlan 50", "policy-map PM_EDGERT_Gi10", " class CM_EDGERT_Gi10", "  set dscp cs0", "interface GigabitEthernet1/0", " service-policy input PM_EDGERT_Gi10", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T12:47:06.283432Z", "interface": "GigabitEthernet0/1", "application": "web", "expected_dscp": "ef", "observed_dscp": "cs3", "vlan": 20, "description": "QoS misclassification on GigabitEthernet0/1: app=web, expected DSCP=ef, observed DSCP=cs3 (VLAN 20)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "vlan": 20, "expected_dscp": "ef", "observed_dscp": "cs3"}], "cli_fix": ["class-map match-any CM_CORER2_Gi01", " match vlan 20", "policy-map PM_CORER2_Gi01", " class CM_CORER2_Gi01", "  set dscp ef", "interface GigabitEthernet0/1", " service-policy input PM_CORER2_Gi01", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T19:52:06.283743Z", "interface": "TenGigabitEthernet1/2", "application": "erp", "expected_dscp": "cs0", "observed_dscp": "ef", "vlan": 20, "description": "QoS misclassification on TenGigabitEthernet1/2: app=erp, expected DSCP=cs0, observed DSCP=ef (VLAN 20)."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "vlan": 20, "expected_dscp": "cs0", "observed_dscp": "ef"}], "cli_fix": ["class-map match-any CM_DCR1_TenGi12", " match vlan 20", "policy-map PM_DCR1_TenGi12", " class CM_DCR1_TenGi12", "  set dscp cs0", "interface TenGigabitEthernet1/2", " service-policy input PM_DCR1_TenGi12", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T19:57:06.284849Z", "interface": "TenGigabitEthernet1/1", "application": "web", "expected_dscp": "af41", "observed_dscp": "cs0", "vlan": 10, "description": "QoS misclassification on TenGigabitEthernet1/1: app=web, expected DSCP=af41, observed DSCP=cs0 (VLAN 10)."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "vlan": 10, "expected_dscp": "af41", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_DCR2_TenGi11", " match vlan 10", "policy-map PM_DCR2_TenGi11", " class CM_DCR2_TenGi11", "  set dscp af41", "interface TenGigabitEthernet1/1", " service-policy input PM_DCR2_TenGi11", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T17:02:06.280191Z", "routing_process": "eigrp", "pid": 346, "stuck_minutes": 33, "symptom": "SPF calculation stuck", "description": "Routing process 'eigrp' appears hung (pid=346), stuck for ~33 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "routing_process": "eigrp", "pid": 346, "stuck_minutes": 33}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T17:23:06.281178Z", "routing_process": "isis", "pid": 2095, "stuck_minutes": 7, "symptom": "RIB update stalled", "description": "Routing process 'isis' appears hung (pid=2095), stuck for ~7 minutes. Symptom: RIB update stalled."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios", "routing_process": "isis", "pid": 2095, "stuck_minutes": 7}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T13:54:06.285624Z", "interface": "TenGigabitEthernet1/2", "class": "VOICE", "drop_rate_pct": 32, "current_rate_kbps": 2000, "suggested_rate_kbps": 4000, "reason": "token bucket depleted", "description": "Policing drops on TenGigabitEthernet1/2 class=VOICE. Current rate 2000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "class": "VOICE", "current_rate_kbps": 2000, "suggested_rate_kbps": 4000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 4000 8000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T15:05:06.282489Z", "interface": "GigabitEthernet0/0", "application": "video", "expected_dscp": "ef", "observed_dscp": "af21", "vlan": 40, "description": "QoS misclassification on GigabitEthernet0/0: app=video, expected DSCP=ef, observed DSCP=af21 (VLAN 40)."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "vlan": 40, "expected_dscp": "ef", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_DCR1_Gi00", " match vlan 40", "policy-map PM_DCR1_Gi00", " class CM_DCR1_Gi00", "  set dscp ef", "interface GigabitEthernet0/0", " service-policy input PM_DCR1_Gi00", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T13:42:06.280560Z", "routing_process": "ospf", "pid": 355, "stuck_minutes": 17, "symptom": "BGP scanner unresponsive", "description": "Routing process 'ospf' appears hung (pid=355), stuck for ~17 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios", "routing_process": "ospf", "pid": 355, "stuck_minutes": 17}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:54:06.287512Z", "interface": "GigabitEthernet0/1", "class": "VOICE", "drop_rate_pct": 38, "current_rate_kbps": 10000, "suggested_rate_kbps": 30000, "reason": "policer exceed drops", "description": "Policing drops on GigabitEthernet0/1 class=VOICE. Current rate 10000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "class": "VOICE", "current_rate_kbps": 10000, "suggested_rate_kbps": 30000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 30000 16000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:25:06.284991Z", "interface": "GigabitEthernet0/1", "application": "video", "expected_dscp": "af31", "observed_dscp": "af41", "vlan": 50, "description": "QoS misclassification on GigabitEthernet0/1: app=video, expected DSCP=af31, observed DSCP=af41 (VLAN 50)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "vlan": 50, "expected_dscp": "af31", "observed_dscp": "af41"}], "cli_fix": ["class-map match-any CM_CORER2_Gi01", " match vlan 50", "policy-map PM_CORER2_Gi01", " class CM_CORER2_Gi01", "  set dscp af31", "interface GigabitEthernet0/1", " service-policy input PM_CORER2_Gi01", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:48:06.280462Z", "routing_process": "eigrp", "pid": 3977, "stuck_minutes": 4, "symptom": "RIB update stalled", "description": "Routing process 'eigrp' appears hung (pid=3977), stuck for ~4 minutes. Symptom: RIB update stalled."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios", "routing_process": "eigrp", "pid": 3977, "stuck_minutes": 4}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T14:28:06.283676Z", "interface": "GigabitEthernet0/0", "application": "video", "expected_dscp": "af41", "observed_dscp": "af31", "vlan": 10, "description": "QoS misclassification on GigabitEthernet0/0: app=video, expected DSCP=af41, observed DSCP=af31 (VLAN 10)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "vlan": 10, "expected_dscp": "af41", "observed_dscp": "af31"}], "cli_fix": ["class-map match-any CM_CORER1_Gi00", " match vlan 10", "policy-map PM_CORER1_Gi00", " class CM_CORER1_Gi00", "  set dscp af41", "interface GigabitEthernet0/0", " service-policy input PM_CORER1_Gi00", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:14:06.285651Z", "interface": "GigabitEthernet0/1", "class": "DATA", "drop_rate_pct": 15, "current_rate_kbps": 1000, "suggested_rate_kbps": 3000, "reason": "burst too small", "description": "Policing drops on GigabitEthernet0/1 class=DATA. Current rate 1000 kbps; drops due to burst too small."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "class": "DATA", "current_rate_kbps": 1000, "suggested_rate_kbps": 3000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 3000 32000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T12:13:06.281085Z", "routing_process": "isis", "pid": 140, "stuck_minutes": 7, "symptom": "SPF calculation stuck", "description": "Routing process 'isis' appears hung (pid=140), stuck for ~7 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "routing_process": "isis", "pid": 140, "stuck_minutes": 7}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T13:20:06.282453Z", "interface": "TenGigabitEthernet1/2", "application": "video", "expected_dscp": "cs0", "observed_dscp": "af31", "vlan": 10, "description": "QoS misclassification on TenGigabitEthernet1/2: app=video, expected DSCP=cs0, observed DSCP=af31 (VLAN 10)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/2", "vlan": 10, "expected_dscp": "cs0", "observed_dscp": "af31"}], "cli_fix": ["class-map match-any CM_CORER1_TenGi12", " match vlan 10", "policy-map PM_CORER1_TenGi12", " class CM_CORER1_TenGi12", "  set dscp cs0", "interface TenGigabitEthernet1/2", " service-policy input PM_CORER1_TenGi12", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T12:35:06.283649Z", "interface": "GigabitEthernet1/0", "application": "voice", "expected_dscp": "cs3", "observed_dscp": "af31", "vlan": 10, "description": "QoS misclassification on GigabitEthernet1/0: app=voice, expected DSCP=cs3, observed DSCP=af31 (VLAN 10)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "vlan": 10, "expected_dscp": "cs3", "observed_dscp": "af31"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi10", " match vlan 10", "policy-map PM_BRANCH_Gi10", " class CM_BRANCH_Gi10", "  set dscp cs3", "interface GigabitEthernet1/0", " service-policy input PM_BRANCH_Gi10", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T18:42:06.284674Z", "interface": "GigabitEthernet0/1", "application": "video", "expected_dscp": "cs3", "observed_dscp": "ef", "vlan": 50, "description": "QoS misclassification on GigabitEthernet0/1: app=video, expected DSCP=cs3, observed DSCP=ef (VLAN 50)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "vlan": 50, "expected_dscp": "cs3", "observed_dscp": "ef"}], "cli_fix": ["class-map match-any CM_CORER2_Gi01", " match vlan 50", "policy-map PM_CORER2_Gi01", " class CM_CORER2_Gi01", "  set dscp cs3", "interface GigabitEthernet0/1", " service-policy input PM_CORER2_Gi01", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T20:34:06.281040Z", "routing_process": "bgp", "pid": 717, "stuck_minutes": 26, "symptom": "Adjacency state not progressing", "description": "Routing process 'bgp' appears hung (pid=717), stuck for ~26 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "routing_process": "bgp", "pid": 717, "stuck_minutes": 26}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T21:34:06.287345Z", "interface": "TenGigabitEthernet1/1", "class": "BULK", "drop_rate_pct": 14, "current_rate_kbps": 20000, "suggested_rate_kbps": 60000, "reason": "rate too low", "description": "Policing drops on TenGigabitEthernet1/1 class=BULK. Current rate 20000 kbps; drops due to rate too low."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "class": "BULK", "current_rate_kbps": 20000, "suggested_rate_kbps": 60000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 60000 16000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T19:06:06.284278Z", "interface": "GigabitEthernet1/0", "application": "video", "expected_dscp": "ef", "observed_dscp": "cs3", "vlan": 40, "description": "QoS misclassification on GigabitEthernet1/0: app=video, expected DSCP=ef, observed DSCP=cs3 (VLAN 40)."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "vlan": 40, "expected_dscp": "ef", "observed_dscp": "cs3"}], "cli_fix": ["class-map match-any CM_DCR2_Gi10", " match vlan 40", "policy-map PM_DCR2_Gi10", " class CM_DCR2_Gi10", "  set dscp ef", "interface GigabitEthernet1/0", " service-policy input PM_DCR2_Gi10", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T13:52:06.287907Z", "interface": "TenGigabitEthernet1/2", "class": "VOICE", "drop_rate_pct": 16, "current_rate_kbps": 1000, "suggested_rate_kbps": 3000, "reason": "burst too small", "description": "Policing drops on TenGigabitEthernet1/2 class=VOICE. Current rate 1000 kbps; drops due to burst too small."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "class": "VOICE", "current_rate_kbps": 1000, "suggested_rate_kbps": 3000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 3000 32000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T11:39:06.287839Z", "interface": "GigabitEthernet0/1", "class": "VOICE", "drop_rate_pct": 11, "current_rate_kbps": 1000, "suggested_rate_kbps": 2000, "reason": "burst too small", "description": "Policing drops on GigabitEthernet0/1 class=VOICE. Current rate 1000 kbps; drops due to burst too small."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "class": "VOICE", "current_rate_kbps": 1000, "suggested_rate_kbps": 2000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 2000 64000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T13:59:06.287824Z", "interface": "TenGigabitEthernet1/1", "class": "VOICE", "drop_rate_pct": 27, "current_rate_kbps": 5000, "suggested_rate_kbps": 15000, "reason": "policer exceed drops", "description": "Policing drops on TenGigabitEthernet1/1 class=VOICE. Current rate 5000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "class": "VOICE", "current_rate_kbps": 5000, "suggested_rate_kbps": 15000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 15000 8000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T20:29:06.280092Z", "routing_process": "bgp", "pid": 421, "stuck_minutes": 14, "symptom": "BGP scanner unresponsive", "description": "Routing process 'bgp' appears hung (pid=421), stuck for ~14 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "routing_process": "bgp", "pid": 421, "stuck_minutes": 14}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T19:09:06.284834Z", "interface": "GigabitEthernet1/0", "application": "voice", "expected_dscp": "af41", "observed_dscp": "cs0", "vlan": 50, "description": "QoS misclassification on GigabitEthernet1/0: app=voice, expected DSCP=af41, observed DSCP=cs0 (VLAN 50)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "vlan": 50, "expected_dscp": "af41", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi10", " match vlan 50", "policy-map PM_BRANCH_Gi10", " class CM_BRANCH_Gi10", "  set dscp af41", "interface GigabitEthernet1/0", " service-policy input PM_BRANCH_Gi10", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T14:36:06.281141Z", "routing_process": "ospf", "pid": 927, "stuck_minutes": 31, "symptom": "SPF calculation stuck", "description": "Routing process 'ospf' appears hung (pid=927), stuck for ~31 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "routing_process": "ospf", "pid": 927, "stuck_minutes": 31}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T12:56:06.284768Z", "interface": "GigabitEthernet0/0", "application": "video", "expected_dscp": "af31", "observed_dscp": "cs3", "vlan": 10, "description": "QoS misclassification on GigabitEthernet0/0: app=video, expected DSCP=af31, observed DSCP=cs3 (VLAN 10)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "vlan": 10, "expected_dscp": "af31", "observed_dscp": "cs3"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi00", " match vlan 10", "policy-map PM_BRANCH_Gi00", " class CM_BRANCH_Gi00", "  set dscp af31", "interface GigabitEthernet0/0", " service-policy input PM_BRANCH_Gi00", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T19:11:06.284245Z", "interface": "GigabitEthernet0/1", "application": "video", "expected_dscp": "cs0", "observed_dscp": "cs3", "vlan": 50, "description": "QoS misclassification on GigabitEthernet0/1: app=video, expected DSCP=cs0, observed DSCP=cs3 (VLAN 50)."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "vlan": 50, "expected_dscp": "cs0", "observed_dscp": "cs3"}], "cli_fix": ["class-map match-any CM_DCR1_Gi01", " match vlan 50", "policy-map PM_DCR1_Gi01", " class CM_DCR1_Gi01", "  set dscp cs0", "interface GigabitEthernet0/1", " service-policy input PM_DCR1_Gi01", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T15:02:06.283813Z", "interface": "GigabitEthernet1/0", "application": "video", "expected_dscp": "ef", "observed_dscp": "af21", "vlan": 10, "description": "QoS misclassification on GigabitEthernet1/0: app=video, expected DSCP=ef, observed DSCP=af21 (VLAN 10)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "vlan": 10, "expected_dscp": "ef", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi10", " match vlan 10", "policy-map PM_BRANCH_Gi10", " class CM_BRANCH_Gi10", "  set dscp ef", "interface GigabitEthernet1/0", " service-policy input PM_BRANCH_Gi10", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T11:37:06.284043Z", "interface": "GigabitEthernet0/1", "application": "web", "expected_dscp": "af21", "observed_dscp": "ef", "vlan": 20, "description": "QoS misclassification on GigabitEthernet0/1: app=web, expected DSCP=af21, observed DSCP=ef (VLAN 20)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "vlan": 20, "expected_dscp": "af21", "observed_dscp": "ef"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi01", " match vlan 20", "policy-map PM_BRANCH_Gi01", " class CM_BRANCH_Gi01", "  set dscp af21", "interface GigabitEthernet0/1", " service-policy input PM_BRANCH_Gi01", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:16:06.287921Z", "interface": "TenGigabitEthernet1/1", "class": "DATA", "drop_rate_pct": 34, "current_rate_kbps": 1000, "suggested_rate_kbps": 3000, "reason": "burst too small", "description": "Policing drops on TenGigabitEthernet1/1 class=DATA. Current rate 1000 kbps; drops due to burst too small."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "class": "DATA", "current_rate_kbps": 1000, "suggested_rate_kbps": 3000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 3000 64000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T16:55:06.280166Z", "routing_process": "isis", "pid": 1630, "stuck_minutes": 21, "symptom": "BGP scanner unresponsive", "description": "Routing process 'isis' appears hung (pid=1630), stuck for ~21 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "routing_process": "isis", "pid": 1630, "stuck_minutes": 21}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T12:41:06.287234Z", "interface": "TenGigabitEthernet1/1", "class": "BULK", "drop_rate_pct": 15, "current_rate_kbps": 1000, "suggested_rate_kbps": 3000, "reason": "burst too small", "description": "Policing drops on TenGigabitEthernet1/1 class=BULK. Current rate 1000 kbps; drops due to burst too small."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "class": "BULK", "current_rate_kbps": 1000, "suggested_rate_kbps": 3000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 3000 16000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T12:55:06.280893Z", "routing_process": "ospf", "pid": 1299, "stuck_minutes": 5, "symptom": "BGP scanner unresponsive", "description": "Routing process 'ospf' appears hung (pid=1299), stuck for ~5 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios", "routing_process": "ospf", "pid": 1299, "stuck_minutes": 5}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T18:34:06.285600Z", "interface": "GigabitEthernet0/1", "class": "VIDEO", "drop_rate_pct": 40, "current_rate_kbps": 1000, "suggested_rate_kbps": 2000, "reason": "burst too small", "description": "Policing drops on GigabitEthernet0/1 class=VIDEO. Current rate 1000 kbps; drops due to burst too small."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "class": "VIDEO", "current_rate_kbps": 1000, "suggested_rate_kbps": 2000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 2000 16000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T16:00:06.284098Z", "interface": "GigabitEthernet0/1", "application": "voice", "expected_dscp": "af41", "observed_dscp": "cs0", "vlan": 40, "description": "QoS misclassification on GigabitEthernet0/1: app=voice, expected DSCP=af41, observed DSCP=cs0 (VLAN 40)."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "vlan": 40, "expected_dscp": "af41", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_DCR2_Gi01", " match vlan 40", "policy-map PM_DCR2_Gi01", " class CM_DCR2_Gi01", "  set dscp af41", "interface GigabitEthernet0/1", " service-policy input PM_DCR2_Gi01", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T17:12:06.286838Z", "interface": "GigabitEthernet1/0", "class": "VOICE", "drop_rate_pct": 23, "current_rate_kbps": 1000, "suggested_rate_kbps": 2000, "reason": "rate too low", "description": "Policing drops on GigabitEthernet1/0 class=VOICE. Current rate 1000 kbps; drops due to rate too low."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "class": "VOICE", "current_rate_kbps": 1000, "suggested_rate_kbps": 2000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 2000 32000 conform-action transmit exceed-action drop", "interface GigabitEthernet1/0", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T16:28:06.282330Z", "interface": "GigabitEthernet0/0", "application": "web", "expected_dscp": "af41", "observed_dscp": "cs0", "vlan": 10, "description": "QoS misclassification on GigabitEthernet0/0: app=web, expected DSCP=af41, observed DSCP=cs0 (VLAN 10)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "vlan": 10, "expected_dscp": "af41", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_CORER1_Gi00", " match vlan 10", "policy-map PM_CORER1_Gi00", " class CM_CORER1_Gi00", "  set dscp af41", "interface GigabitEthernet0/0", " service-policy input PM_CORER1_Gi00", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T13:38:06.281574Z", "routing_process": "bgp", "pid": 303, "stuck_minutes": 14, "symptom": "Routing table not updating", "description": "Routing process 'bgp' appears hung (pid=303), stuck for ~14 minutes. Symptom: Routing table not updating."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "routing_process": "bgp", "pid": 303, "stuck_minutes": 14}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T18:29:06.286718Z", "interface": "TenGigabitEthernet1/1", "class": "VOICE", "drop_rate_pct": 27, "current_rate_kbps": 2000, "suggested_rate_kbps": 4000, "reason": "rate too low", "description": "Policing drops on TenGigabitEthernet1/1 class=VOICE. Current rate 2000 kbps; drops due to rate too low."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "class": "VOICE", "current_rate_kbps": 2000, "suggested_rate_kbps": 4000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 4000 8000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T18:16:06.287761Z", "interface": "GigabitEthernet0/1", "class": "BULK", "drop_rate_pct": 37, "current_rate_kbps": 2000, "suggested_rate_kbps": 4000, "reason": "token bucket depleted", "description": "Policing drops on GigabitEthernet0/1 class=BULK. Current rate 2000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "class": "BULK", "current_rate_kbps": 2000, "suggested_rate_kbps": 4000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 4000 16000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T17:21:06.285177Z", "interface": "TenGigabitEthernet1/1", "application": "erp", "expected_dscp": "af41", "observed_dscp": "af21", "vlan": 20, "description": "QoS misclassification on TenGigabitEthernet1/1: app=erp, expected DSCP=af41, observed DSCP=af21 (VLAN 20)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "vlan": 20, "expected_dscp": "af41", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_EDGERT_TenGi11", " match vlan 20", "policy-map PM_EDGERT_TenGi11", " class CM_EDGERT_TenGi11", "  set dscp af41", "interface TenGigabitEthernet1/1", " service-policy input PM_EDGERT_TenGi11", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T21:22:06.288299Z", "interface": "GigabitEthernet0/0", "class": "DATA", "drop_rate_pct": 8, "current_rate_kbps": 10000, "suggested_rate_kbps": 20000, "reason": "policer exceed drops", "description": "Policing drops on GigabitEthernet0/0 class=DATA. Current rate 10000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "class": "DATA", "current_rate_kbps": 10000, "suggested_rate_kbps": 20000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 20000 32000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/0", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T14:06:06.286268Z", "interface": "GigabitEthernet1/0", "class": "DATA", "drop_rate_pct": 39, "current_rate_kbps": 5000, "suggested_rate_kbps": 15000, "reason": "token bucket depleted", "description": "Policing drops on GigabitEthernet1/0 class=DATA. Current rate 5000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "class": "DATA", "current_rate_kbps": 5000, "suggested_rate_kbps": 15000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 15000 16000 conform-action transmit exceed-action drop", "interface GigabitEthernet1/0", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:32:06.283386Z", "interface": "GigabitEthernet0/1", "application": "backup", "expected_dscp": "af31", "observed_dscp": "af41", "vlan": 10, "description": "QoS misclassification on GigabitEthernet0/1: app=backup, expected DSCP=af31, observed DSCP=af41 (VLAN 10)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "vlan": 10, "expected_dscp": "af31", "observed_dscp": "af41"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi01", " match vlan 10", "policy-map PM_BRANCH_Gi01", " class CM_BRANCH_Gi01", "  set dscp af31", "interface GigabitEthernet0/1", " service-policy input PM_BRANCH_Gi01", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T18:02:06.280468Z", "routing_process": "eigrp", "pid": 515, "stuck_minutes": 3, "symptom": "SPF calculation stuck", "description": "Routing process 'eigrp' appears hung (pid=515), stuck for ~3 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios_xe", "routing_process": "eigrp", "pid": 515, "stuck_minutes": 3}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T20:24:06.280809Z", "routing_process": "bgp", "pid": 4869, "stuck_minutes": 20, "symptom": "Adjacency state not progressing", "description": "Routing process 'bgp' appears hung (pid=4869), stuck for ~20 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "routing_process": "bgp", "pid": 4869, "stuck_minutes": 20}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T20:21:06.286188Z", "interface": "TenGigabitEthernet1/1", "class": "BULK", "drop_rate_pct": 23, "current_rate_kbps": 20000, "suggested_rate_kbps": 60000, "reason": "token bucket depleted", "description": "Policing drops on TenGigabitEthernet1/1 class=BULK. Current rate 20000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "class": "BULK", "current_rate_kbps": 20000, "suggested_rate_kbps": 60000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 60000 64000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T18:42:06.288261Z", "interface": "TenGigabitEthernet1/2", "class": "VIDEO", "drop_rate_pct": 6, "current_rate_kbps": 5000, "suggested_rate_kbps": 10000, "reason": "token bucket depleted", "description": "Policing drops on TenGigabitEthernet1/2 class=VIDEO. Current rate 5000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/2", "class": "VIDEO", "current_rate_kbps": 5000, "suggested_rate_kbps": 10000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 10000 8000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T14:07:06.281819Z", "interface": "TenGigabitEthernet1/1", "application": "video", "expected_dscp": "cs0", "observed_dscp": "cs3", "vlan": 30, "description": "QoS misclassification on TenGigabitEthernet1/1: app=video, expected DSCP=cs0, observed DSCP=cs3 (VLAN 30)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "vlan": 30, "expected_dscp": "cs0", "observed_dscp": "cs3"}], "cli_fix": ["class-map match-any CM_CORER1_TenGi11", " match vlan 30", "policy-map PM_CORER1_TenGi11", " class CM_CORER1_TenGi11", "  set dscp cs0", "interface TenGigabitEthernet1/1", " service-policy input PM_CORER1_TenGi11", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T18:09:06.285673Z", "interface": "TenGigabitEthernet1/2", "class": "BULK", "drop_rate_pct": 32, "current_rate_kbps": 20000, "suggested_rate_kbps": 60000, "reason": "policer exceed drops", "description": "Policing drops on TenGigabitEthernet1/2 class=BULK. Current rate 20000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "class": "BULK", "current_rate_kbps": 20000, "suggested_rate_kbps": 60000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 60000 16000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T14:02:06.285474Z", "interface": "GigabitEthernet1/0", "class": "BULK", "drop_rate_pct": 25, "current_rate_kbps": 1000, "suggested_rate_kbps": 2000, "reason": "rate too low", "description": "Policing drops on GigabitEthernet1/0 class=BULK. Current rate 1000 kbps; drops due to rate too low."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "class": "BULK", "current_rate_kbps": 1000, "suggested_rate_kbps": 2000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 2000 32000 conform-action transmit exceed-action drop", "interface GigabitEthernet1/0", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T18:05:06.281380Z", "routing_process": "isis", "pid": 2273, "stuck_minutes": 28, "symptom": "SPF calculation stuck", "description": "Routing process 'isis' appears hung (pid=2273), stuck for ~28 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "routing_process": "isis", "pid": 2273, "stuck_minutes": 28}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:46:06.285568Z", "interface": "GigabitEthernet1/0", "class": "VOICE", "drop_rate_pct": 13, "current_rate_kbps": 10000, "suggested_rate_kbps": 20000, "reason": "token bucket depleted", "description": "Policing drops on GigabitEthernet1/0 class=VOICE. Current rate 10000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "class": "VOICE", "current_rate_kbps": 10000, "suggested_rate_kbps": 20000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 20000 32000 conform-action transmit exceed-action drop", "interface GigabitEthernet1/0", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T20:51:06.284396Z", "interface": "GigabitEthernet1/0", "application": "voice", "expected_dscp": "ef", "observed_dscp": "cs0", "vlan": 10, "description": "QoS misclassification on GigabitEthernet1/0: app=voice, expected DSCP=ef, observed DSCP=cs0 (VLAN 10)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "vlan": 10, "expected_dscp": "ef", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi10", " match vlan 10", "policy-map PM_BRANCH_Gi10", " class CM_BRANCH_Gi10", "  set dscp ef", "interface GigabitEthernet1/0", " service-policy input PM_BRANCH_Gi10", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T15:41:06.280045Z", "routing_process": "isis", "pid": 4317, "stuck_minutes": 4, "symptom": "Adjacency state not progressing", "description": "Routing process 'isis' appears hung (pid=4317), stuck for ~4 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "routing_process": "isis", "pid": 4317, "stuck_minutes": 4}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T19:27:06.286809Z", "interface": "GigabitEthernet0/1", "class": "DATA", "drop_rate_pct": 28, "current_rate_kbps": 20000, "suggested_rate_kbps": 60000, "reason": "burst too small", "description": "Policing drops on GigabitEthernet0/1 class=DATA. Current rate 20000 kbps; drops due to burst too small."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "class": "DATA", "current_rate_kbps": 20000, "suggested_rate_kbps": 60000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 60000 16000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T21:14:06.280759Z", "routing_process": "bgp", "pid": 326, "stuck_minutes": 8, "symptom": "SPF calculation stuck", "description": "Routing process 'bgp' appears hung (pid=326), stuck for ~8 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "routing_process": "bgp", "pid": 326, "stuck_minutes": 8}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T19:27:06.284964Z", "interface": "TenGigabitEthernet1/1", "application": "video", "expected_dscp": "cs0", "observed_dscp": "ef", "vlan": 30, "description": "QoS misclassification on TenGigabitEthernet1/1: app=video, expected DSCP=cs0, observed DSCP=ef (VLAN 30)."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "vlan": 30, "expected_dscp": "cs0", "observed_dscp": "ef"}], "cli_fix": ["class-map match-any CM_DCR1_TenGi11", " match vlan 30", "policy-map PM_DCR1_TenGi11", " class CM_DCR1_TenGi11", "  set dscp cs0", "interface TenGigabitEthernet1/1", " service-policy input PM_DCR1_TenGi11", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T12:17:06.281804Z", "interface": "TenGigabitEthernet1/2", "application": "video", "expected_dscp": "cs0", "observed_dscp": "ef", "vlan": 20, "description": "QoS misclassification on TenGigabitEthernet1/2: app=video, expected DSCP=cs0, observed DSCP=ef (VLAN 20)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "vlan": 20, "expected_dscp": "cs0", "observed_dscp": "ef"}], "cli_fix": ["class-map match-any CM_EDGERT_TenGi12", " match vlan 20", "policy-map PM_EDGERT_TenGi12", " class CM_EDGERT_TenGi12", "  set dscp cs0", "interface TenGigabitEthernet1/2", " service-policy input PM_EDGERT_TenGi12", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T20:19:06.287315Z", "interface": "GigabitEthernet0/0", "class": "VIDEO", "drop_rate_pct": 16, "current_rate_kbps": 20000, "suggested_rate_kbps": 60000, "reason": "burst too small", "description": "Policing drops on GigabitEthernet0/0 class=VIDEO. Current rate 20000 kbps; drops due to burst too small."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "class": "VIDEO", "current_rate_kbps": 20000, "suggested_rate_kbps": 60000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 60000 32000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/0", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T17:11:06.281935Z", "interface": "TenGigabitEthernet1/1", "application": "web", "expected_dscp": "af21", "observed_dscp": "cs0", "vlan": 50, "description": "QoS misclassification on TenGigabitEthernet1/1: app=web, expected DSCP=af21, observed DSCP=cs0 (VLAN 50)."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "vlan": 50, "expected_dscp": "af21", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_DCR2_TenGi11", " match vlan 50", "policy-map PM_DCR2_TenGi11", " class CM_DCR2_TenGi11", "  set dscp af21", "interface TenGigabitEthernet1/1", " service-policy input PM_DCR2_TenGi11", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T14:55:06.280482Z", "routing_process": "isis", "pid": 3733, "stuck_minutes": 32, "symptom": "BGP scanner unresponsive", "description": "Routing process 'isis' appears hung (pid=3733), stuck for ~32 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios_xe", "routing_process": "isis", "pid": 3733, "stuck_minutes": 32}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T12:25:06.281859Z", "interface": "TenGigabitEthernet1/1", "application": "voice", "expected_dscp": "cs0", "observed_dscp": "af41", "vlan": 50, "description": "QoS misclassification on TenGigabitEthernet1/1: app=voice, expected DSCP=cs0, observed DSCP=af41 (VLAN 50)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "vlan": 50, "expected_dscp": "cs0", "observed_dscp": "af41"}], "cli_fix": ["class-map match-any CM_EDGERT_TenGi11", " match vlan 50", "policy-map PM_EDGERT_TenGi11", " class CM_EDGERT_TenGi11", "  set dscp cs0", "interface TenGigabitEthernet1/1", " service-policy input PM_EDGERT_TenGi11", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:59:06.287125Z", "interface": "GigabitEthernet0/0", "class": "DATA", "drop_rate_pct": 31, "current_rate_kbps": 10000, "suggested_rate_kbps": 30000, "reason": "burst too small", "description": "Policing drops on GigabitEthernet0/0 class=DATA. Current rate 10000 kbps; drops due to burst too small."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "class": "DATA", "current_rate_kbps": 10000, "suggested_rate_kbps": 30000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 30000 32000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/0", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T18:13:06.280720Z", "routing_process": "isis", "pid": 3167, "stuck_minutes": 7, "symptom": "Adjacency state not progressing", "description": "Routing process 'isis' appears hung (pid=3167), stuck for ~7 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios_xe", "routing_process": "isis", "pid": 3167, "stuck_minutes": 7}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T11:40:06.286391Z", "interface": "GigabitEthernet0/0", "class": "VIDEO", "drop_rate_pct": 9, "current_rate_kbps": 10000, "suggested_rate_kbps": 20000, "reason": "token bucket depleted", "description": "Policing drops on GigabitEthernet0/0 class=VIDEO. Current rate 10000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "class": "VIDEO", "current_rate_kbps": 10000, "suggested_rate_kbps": 20000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 20000 8000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/0", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T20:10:06.281706Z", "routing_process": "eigrp", "pid": 1453, "stuck_minutes": 4, "symptom": "Adjacency state not progressing", "description": "Routing process 'eigrp' appears hung (pid=1453), stuck for ~4 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "routing_process": "eigrp", "pid": 1453, "stuck_minutes": 4}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T12:14:06.283994Z", "interface": "GigabitEthernet1/0", "application": "voice", "expected_dscp": "af21", "observed_dscp": "af31", "vlan": 10, "description": "QoS misclassification on GigabitEthernet1/0: app=voice, expected DSCP=af21, observed DSCP=af31 (VLAN 10)."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "vlan": 10, "expected_dscp": "af21", "observed_dscp": "af31"}], "cli_fix": ["class-map match-any CM_DCR2_Gi10", " match vlan 10", "policy-map PM_DCR2_Gi10", " class CM_DCR2_Gi10", "  set dscp af21", "interface GigabitEthernet1/0", " service-policy input PM_DCR2_Gi10", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T13:27:06.286898Z", "interface": "GigabitEthernet1/0", "class": "VIDEO", "drop_rate_pct": 12, "current_rate_kbps": 10000, "suggested_rate_kbps": 30000, "reason": "burst too small", "description": "Policing drops on GigabitEthernet1/0 class=VIDEO. Current rate 10000 kbps; drops due to burst too small."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "class": "VIDEO", "current_rate_kbps": 10000, "suggested_rate_kbps": 30000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 30000 32000 conform-action transmit exceed-action drop", "interface GigabitEthernet1/0", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:06:06.282517Z", "interface": "TenGigabitEthernet1/1", "application": "web", "expected_dscp": "af31", "observed_dscp": "ef", "vlan": 20, "description": "QoS misclassification on TenGigabitEthernet1/1: app=web, expected DSCP=af31, observed DSCP=ef (VLAN 20)."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "vlan": 20, "expected_dscp": "af31", "observed_dscp": "ef"}], "cli_fix": ["class-map match-any CM_DCR2_TenGi11", " match vlan 20", "policy-map PM_DCR2_TenGi11", " class CM_DCR2_TenGi11", "  set dscp af31", "interface TenGigabitEthernet1/1", " service-policy input PM_DCR2_TenGi11", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T14:05:06.283720Z", "interface": "GigabitEthernet0/0", "application": "backup", "expected_dscp": "af21", "observed_dscp": "cs3", "vlan": 20, "description": "QoS misclassification on GigabitEthernet0/0: app=backup, expected DSCP=af21, observed DSCP=cs3 (VLAN 20)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "vlan": 20, "expected_dscp": "af21", "observed_dscp": "cs3"}], "cli_fix": ["class-map match-any CM_CORER2_Gi00", " match vlan 20", "policy-map PM_CORER2_Gi00", " class CM_CORER2_Gi00", "  set dscp af21", "interface GigabitEthernet0/0", " service-policy input PM_CORER2_Gi00", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T18:38:06.286627Z", "interface": "TenGigabitEthernet1/2", "class": "BULK", "drop_rate_pct": 5, "current_rate_kbps": 20000, "suggested_rate_kbps": 40000, "reason": "rate too low", "description": "Policing drops on TenGigabitEthernet1/2 class=BULK. Current rate 20000 kbps; drops due to rate too low."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/2", "class": "BULK", "current_rate_kbps": 20000, "suggested_rate_kbps": 40000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 40000 32000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T18:14:06.284352Z", "interface": "TenGigabitEthernet1/1", "application": "web", "expected_dscp": "ef", "observed_dscp": "af21", "vlan": 50, "description": "QoS misclassification on TenGigabitEthernet1/1: app=web, expected DSCP=ef, observed DSCP=af21 (VLAN 50)."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "vlan": 50, "expected_dscp": "ef", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_DCR2_TenGi11", " match vlan 50", "policy-map PM_DCR2_TenGi11", " class CM_DCR2_TenGi11", "  set dscp ef", "interface TenGigabitEthernet1/1", " service-policy input PM_DCR2_TenGi11", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T19:37:06.283982Z", "interface": "TenGigabitEthernet1/1", "application": "backup", "expected_dscp": "af21", "observed_dscp": "af41", "vlan": 50, "description": "QoS misclassification on TenGigabitEthernet1/1: app=backup, expected DSCP=af21, observed DSCP=af41 (VLAN 50)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "vlan": 50, "expected_dscp": "af21", "observed_dscp": "af41"}], "cli_fix": ["class-map match-any CM_CORER1_TenGi11", " match vlan 50", "policy-map PM_CORER1_TenGi11", " class CM_CORER1_TenGi11", "  set dscp af21", "interface TenGigabitEthernet1/1", " service-policy input PM_CORER1_TenGi11", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T16:46:06.280617Z", "routing_process": "eigrp", "pid": 2508, "stuck_minutes": 37, "symptom": "BGP scanner unresponsive", "description": "Routing process 'eigrp' appears hung (pid=2508), stuck for ~37 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios_xe", "routing_process": "eigrp", "pid": 2508, "stuck_minutes": 37}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T18:56:06.281071Z", "routing_process": "isis", "pid": 2985, "stuck_minutes": 32, "symptom": "BGP scanner unresponsive", "description": "Routing process 'isis' appears hung (pid=2985), stuck for ~32 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "routing_process": "isis", "pid": 2985, "stuck_minutes": 32}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T13:55:06.281487Z", "routing_process": "isis", "pid": 2139, "stuck_minutes": 40, "symptom": "BGP scanner unresponsive", "description": "Routing process 'isis' appears hung (pid=2139), stuck for ~40 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "routing_process": "isis", "pid": 2139, "stuck_minutes": 40}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T13:27:06.279643Z", "routing_process": "eigrp", "pid": 3903, "stuck_minutes": 32, "symptom": "Routing table not updating", "description": "Routing process 'eigrp' appears hung (pid=3903), stuck for ~32 minutes. Symptom: Routing table not updating."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "routing_process": "eigrp", "pid": 3903, "stuck_minutes": 32}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T13:09:06.286797Z", "interface": "TenGigabitEthernet1/2", "class": "BULK", "drop_rate_pct": 33, "current_rate_kbps": 10000, "suggested_rate_kbps": 30000, "reason": "policer exceed drops", "description": "Policing drops on TenGigabitEthernet1/2 class=BULK. Current rate 10000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "class": "BULK", "current_rate_kbps": 10000, "suggested_rate_kbps": 30000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 30000 8000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T16:37:06.282584Z", "interface": "TenGigabitEthernet1/2", "application": "web", "expected_dscp": "cs0", "observed_dscp": "af21", "vlan": 50, "description": "QoS misclassification on TenGigabitEthernet1/2: app=web, expected DSCP=cs0, observed DSCP=af21 (VLAN 50)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "vlan": 50, "expected_dscp": "cs0", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_BRANCH_TenGi12", " match vlan 50", "policy-map PM_BRANCH_TenGi12", " class CM_BRANCH_TenGi12", "  set dscp cs0", "interface TenGigabitEthernet1/2", " service-policy input PM_BRANCH_TenGi12", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:02:06.287800Z", "interface": "GigabitEthernet0/1", "class": "BULK", "drop_rate_pct": 16, "current_rate_kbps": 2000, "suggested_rate_kbps": 4000, "reason": "rate too low", "description": "Policing drops on GigabitEthernet0/1 class=BULK. Current rate 2000 kbps; drops due to rate too low."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "class": "BULK", "current_rate_kbps": 2000, "suggested_rate_kbps": 4000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 4000 8000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T11:51:06.287752Z", "interface": "GigabitEthernet0/0", "class": "VIDEO", "drop_rate_pct": 21, "current_rate_kbps": 10000, "suggested_rate_kbps": 20000, "reason": "rate too low", "description": "Policing drops on GigabitEthernet0/0 class=VIDEO. Current rate 10000 kbps; drops due to rate too low."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "class": "VIDEO", "current_rate_kbps": 10000, "suggested_rate_kbps": 20000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 20000 16000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/0", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T14:19:06.281110Z", "routing_process": "isis", "pid": 2263, "stuck_minutes": 30, "symptom": "SPF calculation stuck", "description": "Routing process 'isis' appears hung (pid=2263), stuck for ~30 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "routing_process": "isis", "pid": 2263, "stuck_minutes": 30}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T13:09:06.287276Z", "interface": "GigabitEthernet0/0", "class": "VIDEO", "drop_rate_pct": 25, "current_rate_kbps": 10000, "suggested_rate_kbps": 30000, "reason": "burst too small", "description": "Policing drops on GigabitEthernet0/0 class=VIDEO. Current rate 10000 kbps; drops due to burst too small."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "class": "VIDEO", "current_rate_kbps": 10000, "suggested_rate_kbps": 30000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 30000 8000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/0", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T16:11:06.281429Z", "routing_process": "isis", "pid": 747, "stuck_minutes": 29, "symptom": "RIB update stalled", "description": "Routing process 'isis' appears hung (pid=747), stuck for ~29 minutes. Symptom: RIB update stalled."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "routing_process": "isis", "pid": 747, "stuck_minutes": 29}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T18:43:06.284875Z", "interface": "GigabitEthernet1/0", "application": "web", "expected_dscp": "cs3", "observed_dscp": "cs0", "vlan": 30, "description": "QoS misclassification on GigabitEthernet1/0: app=web, expected DSCP=cs3, observed DSCP=cs0 (VLAN 30)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "vlan": 30, "expected_dscp": "cs3", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi10", " match vlan 30", "policy-map PM_BRANCH_Gi10", " class CM_BRANCH_Gi10", "  set dscp cs3", "interface GigabitEthernet1/0", " service-policy input PM_BRANCH_Gi10", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T15:10:06.287252Z", "interface": "TenGigabitEthernet1/2", "class": "VIDEO", "drop_rate_pct": 28, "current_rate_kbps": 2000, "suggested_rate_kbps": 6000, "reason": "burst too small", "description": "Policing drops on TenGigabitEthernet1/2 class=VIDEO. Current rate 2000 kbps; drops due to burst too small."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "class": "VIDEO", "current_rate_kbps": 2000, "suggested_rate_kbps": 6000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 6000 32000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T19:56:06.287641Z", "interface": "GigabitEthernet0/1", "class": "DATA", "drop_rate_pct": 6, "current_rate_kbps": 20000, "suggested_rate_kbps": 40000, "reason": "policer exceed drops", "description": "Policing drops on GigabitEthernet0/1 class=DATA. Current rate 20000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "class": "DATA", "current_rate_kbps": 20000, "suggested_rate_kbps": 40000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 40000 32000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T11:45:06.286181Z", "interface": "TenGigabitEthernet1/1", "class": "VIDEO", "drop_rate_pct": 10, "current_rate_kbps": 10000, "suggested_rate_kbps": 30000, "reason": "policer exceed drops", "description": "Policing drops on TenGigabitEthernet1/1 class=VIDEO. Current rate 10000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "class": "VIDEO", "current_rate_kbps": 10000, "suggested_rate_kbps": 30000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 30000 64000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T18:11:06.285040Z", "interface": "GigabitEthernet1/0", "application": "web", "expected_dscp": "cs0", "observed_dscp": "af41", "vlan": 30, "description": "QoS misclassification on GigabitEthernet1/0: app=web, expected DSCP=cs0, observed DSCP=af41 (VLAN 30)."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "vlan": 30, "expected_dscp": "cs0", "observed_dscp": "af41"}], "cli_fix": ["class-map match-any CM_DCR1_Gi10", " match vlan 30", "policy-map PM_DCR1_Gi10", " class CM_DCR1_Gi10", "  set dscp cs0", "interface GigabitEthernet1/0", " service-policy input PM_DCR1_Gi10", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T17:30:06.284741Z", "interface": "GigabitEthernet0/0", "application": "web", "expected_dscp": "af31", "observed_dscp": "af41", "vlan": 30, "description": "QoS misclassification on GigabitEthernet0/0: app=web, expected DSCP=af31, observed DSCP=af41 (VLAN 30)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "vlan": 30, "expected_dscp": "af31", "observed_dscp": "af41"}], "cli_fix": ["class-map match-any CM_EDGERT_Gi00", " match vlan 30", "policy-map PM_EDGERT_Gi00", " class CM_EDGERT_Gi00", "  set dscp af31", "interface GigabitEthernet0/0", " service-policy input PM_EDGERT_Gi00", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T17:26:06.280880Z", "routing_process": "ospf", "pid": 517, "stuck_minutes": 33, "symptom": "SPF calculation stuck", "description": "Routing process 'ospf' appears hung (pid=517), stuck for ~33 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "routing_process": "ospf", "pid": 517, "stuck_minutes": 33}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T12:16:06.281300Z", "routing_process": "bgp", "pid": 3164, "stuck_minutes": 8, "symptom": "Adjacency state not progressing", "description": "Routing process 'bgp' appears hung (pid=3164), stuck for ~8 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios_xe", "routing_process": "bgp", "pid": 3164, "stuck_minutes": 8}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T12:35:06.286174Z", "interface": "GigabitEthernet0/1", "class": "VIDEO", "drop_rate_pct": 13, "current_rate_kbps": 10000, "suggested_rate_kbps": 20000, "reason": "rate too low", "description": "Policing drops on GigabitEthernet0/1 class=VIDEO. Current rate 10000 kbps; drops due to rate too low."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "class": "VIDEO", "current_rate_kbps": 10000, "suggested_rate_kbps": 20000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 20000 8000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T13:41:06.280418Z", "routing_process": "bgp", "pid": 1204, "stuck_minutes": 36, "symptom": "RIB update stalled", "description": "Routing process 'bgp' appears hung (pid=1204), stuck for ~36 minutes. Symptom: RIB update stalled."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "routing_process": "bgp", "pid": 1204, "stuck_minutes": 36}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T16:56:06.283010Z", "interface": "GigabitEthernet1/0", "application": "erp", "expected_dscp": "cs3", "observed_dscp": "af21", "vlan": 50, "description": "QoS misclassification on GigabitEthernet1/0: app=erp, expected DSCP=cs3, observed DSCP=af21 (VLAN 50)."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "vlan": 50, "expected_dscp": "cs3", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_DCR2_Gi10", " match vlan 50", "policy-map PM_DCR2_Gi10", " class CM_DCR2_Gi10", "  set dscp cs3", "interface GigabitEthernet1/0", " service-policy input PM_DCR2_Gi10", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T15:06:06.281891Z", "interface": "TenGigabitEthernet1/1", "application": "voice", "expected_dscp": "cs3", "observed_dscp": "ef", "vlan": 30, "description": "QoS misclassification on TenGigabitEthernet1/1: app=voice, expected DSCP=cs3, observed DSCP=ef (VLAN 30)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "vlan": 30, "expected_dscp": "cs3", "observed_dscp": "ef"}], "cli_fix": ["class-map match-any CM_BRANCH_TenGi11", " match vlan 30", "policy-map PM_BRANCH_TenGi11", " class CM_BRANCH_TenGi11", "  set dscp cs3", "interface TenGigabitEthernet1/1", " service-policy input PM_BRANCH_TenGi11", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T15:56:06.285264Z", "interface": "GigabitEthernet0/0", "application": "video", "expected_dscp": "cs3", "observed_dscp": "ef", "vlan": 10, "description": "QoS misclassification on GigabitEthernet0/0: app=video, expected DSCP=cs3, observed DSCP=ef (VLAN 10)."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "vlan": 10, "expected_dscp": "cs3", "observed_dscp": "ef"}], "cli_fix": ["class-map match-any CM_DCR2_Gi00", " match vlan 10", "policy-map PM_DCR2_Gi00", " class CM_DCR2_Gi00", "  set dscp cs3", "interface GigabitEthernet0/0", " service-policy input PM_DCR2_Gi00", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T12:45:06.288221Z", "interface": "TenGigabitEthernet1/1", "class": "BULK", "drop_rate_pct": 30, "current_rate_kbps": 10000, "suggested_rate_kbps": 30000, "reason": "burst too small", "description": "Policing drops on TenGigabitEthernet1/1 class=BULK. Current rate 10000 kbps; drops due to burst too small."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "class": "BULK", "current_rate_kbps": 10000, "suggested_rate_kbps": 30000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 30000 16000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T12:33:06.286151Z", "interface": "GigabitEthernet1/0", "class": "DATA", "drop_rate_pct": 39, "current_rate_kbps": 5000, "suggested_rate_kbps": 15000, "reason": "burst too small", "description": "Policing drops on GigabitEthernet1/0 class=DATA. Current rate 5000 kbps; drops due to burst too small."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "class": "DATA", "current_rate_kbps": 5000, "suggested_rate_kbps": 15000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 15000 8000 conform-action transmit exceed-action drop", "interface GigabitEthernet1/0", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T15:21:06.286347Z", "interface": "TenGigabitEthernet1/1", "class": "VIDEO", "drop_rate_pct": 38, "current_rate_kbps": 20000, "suggested_rate_kbps": 40000, "reason": "token bucket depleted", "description": "Policing drops on TenGigabitEthernet1/1 class=VIDEO. Current rate 20000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "class": "VIDEO", "current_rate_kbps": 20000, "suggested_rate_kbps": 40000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 40000 64000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T11:58:06.286709Z", "interface": "GigabitEthernet1/0", "class": "DATA", "drop_rate_pct": 6, "current_rate_kbps": 10000, "suggested_rate_kbps": 20000, "reason": "token bucket depleted", "description": "Policing drops on GigabitEthernet1/0 class=DATA. Current rate 10000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "class": "DATA", "current_rate_kbps": 10000, "suggested_rate_kbps": 20000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 20000 8000 conform-action transmit exceed-action drop", "interface GigabitEthernet1/0", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T13:02:06.286942Z", "interface": "TenGigabitEthernet1/2", "class": "VOICE", "drop_rate_pct": 8, "current_rate_kbps": 20000, "suggested_rate_kbps": 60000, "reason": "rate too low", "description": "Policing drops on TenGigabitEthernet1/2 class=VOICE. Current rate 20000 kbps; drops due to rate too low."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/2", "class": "VOICE", "current_rate_kbps": 20000, "suggested_rate_kbps": 60000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 60000 64000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T19:34:06.279667Z", "routing_process": "isis", "pid": 614, "stuck_minutes": 19, "symptom": "Routing table not updating", "description": "Routing process 'isis' appears hung (pid=614), stuck for ~19 minutes. Symptom: Routing table not updating."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios_xe", "routing_process": "isis", "pid": 614, "stuck_minutes": 19}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T19:22:06.280635Z", "routing_process": "ospf", "pid": 4789, "stuck_minutes": 31, "symptom": "SPF calculation stuck", "description": "Routing process 'ospf' appears hung (pid=4789), stuck for ~31 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios_xe", "routing_process": "ospf", "pid": 4789, "stuck_minutes": 31}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T20:41:06.281605Z", "routing_process": "eigrp", "pid": 2063, "stuck_minutes": 34, "symptom": "BGP scanner unresponsive", "description": "Routing process 'eigrp' appears hung (pid=2063), stuck for ~34 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "routing_process": "eigrp", "pid": 2063, "stuck_minutes": 34}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T20:16:06.286002Z", "interface": "GigabitEthernet0/0", "class": "VOICE", "drop_rate_pct": 22, "current_rate_kbps": 1000, "suggested_rate_kbps": 3000, "reason": "policer exceed drops", "description": "Policing drops on GigabitEthernet0/0 class=VOICE. Current rate 1000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "class": "VOICE", "current_rate_kbps": 1000, "suggested_rate_kbps": 3000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 3000 16000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/0", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T17:15:06.281587Z", "routing_process": "bgp", "pid": 2278, "stuck_minutes": 30, "symptom": "Adjacency state not progressing", "description": "Routing process 'bgp' appears hung (pid=2278), stuck for ~30 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "routing_process": "bgp", "pid": 2278, "stuck_minutes": 30}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T15:57:06.285067Z", "interface": "GigabitEthernet0/0", "application": "backup", "expected_dscp": "af41", "observed_dscp": "af21", "vlan": 20, "description": "QoS misclassification on GigabitEthernet0/0: app=backup, expected DSCP=af41, observed DSCP=af21 (VLAN 20)."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "vlan": 20, "expected_dscp": "af41", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_DCR2_Gi00", " match vlan 20", "policy-map PM_DCR2_Gi00", " class CM_DCR2_Gi00", "  set dscp af41", "interface GigabitEthernet0/0", " service-policy input PM_DCR2_Gi00", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T11:44:06.282625Z", "interface": "TenGigabitEthernet1/2", "application": "voice", "expected_dscp": "ef", "observed_dscp": "af21", "vlan": 40, "description": "QoS misclassification on TenGigabitEthernet1/2: app=voice, expected DSCP=ef, observed DSCP=af21 (VLAN 40)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "vlan": 40, "expected_dscp": "ef", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_BRANCH_TenGi12", " match vlan 40", "policy-map PM_BRANCH_TenGi12", " class CM_BRANCH_TenGi12", "  set dscp ef", "interface TenGigabitEthernet1/2", " service-policy input PM_BRANCH_TenGi12", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T15:22:06.285030Z", "interface": "TenGigabitEthernet1/1", "application": "backup", "expected_dscp": "af21", "observed_dscp": "cs3", "vlan": 40, "description": "QoS misclassification on TenGigabitEthernet1/1: app=backup, expected DSCP=af21, observed DSCP=cs3 (VLAN 40)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "vlan": 40, "expected_dscp": "af21", "observed_dscp": "cs3"}], "cli_fix": ["class-map match-any CM_CORER1_TenGi11", " match vlan 40", "policy-map PM_CORER1_TenGi11", " class CM_CORER1_TenGi11", "  set dscp af21", "interface TenGigabitEthernet1/1", " service-policy input PM_CORER1_TenGi11", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T11:45:06.281617Z", "routing_process": "bgp", "pid": 2176, "stuck_minutes": 14, "symptom": "Routing table not updating", "description": "Routing process 'bgp' appears hung (pid=2176), stuck for ~14 minutes. Symptom: Routing table not updating."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "routing_process": "bgp", "pid": 2176, "stuck_minutes": 14}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T14:00:06.283280Z", "interface": "TenGigabitEthernet1/2", "application": "erp", "expected_dscp": "af21", "observed_dscp": "cs3", "vlan": 10, "description": "QoS misclassification on TenGigabitEthernet1/2: app=erp, expected DSCP=af21, observed DSCP=cs3 (VLAN 10)."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/2", "vlan": 10, "expected_dscp": "af21", "observed_dscp": "cs3"}], "cli_fix": ["class-map match-any CM_DCR2_TenGi12", " match vlan 10", "policy-map PM_DCR2_TenGi12", " class CM_DCR2_TenGi12", "  set dscp af21", "interface TenGigabitEthernet1/2", " service-policy input PM_DCR2_TenGi12", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T14:03:06.281686Z", "routing_process": "ospf", "pid": 1298, "stuck_minutes": 12, "symptom": "SPF calculation stuck", "description": "Routing process 'ospf' appears hung (pid=1298), stuck for ~12 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "routing_process": "ospf", "pid": 1298, "stuck_minutes": 12}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T12:54:06.280368Z", "routing_process": "bgp", "pid": 2284, "stuck_minutes": 5, "symptom": "Routing table not updating", "description": "Routing process 'bgp' appears hung (pid=2284), stuck for ~5 minutes. Symptom: Routing table not updating."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "routing_process": "bgp", "pid": 2284, "stuck_minutes": 5}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T17:52:06.285957Z", "interface": "TenGigabitEthernet1/1", "class": "DATA", "drop_rate_pct": 40, "current_rate_kbps": 1000, "suggested_rate_kbps": 3000, "reason": "burst too small", "description": "Policing drops on TenGigabitEthernet1/1 class=DATA. Current rate 1000 kbps; drops due to burst too small."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "class": "DATA", "current_rate_kbps": 1000, "suggested_rate_kbps": 3000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 3000 32000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T20:16:06.284022Z", "interface": "GigabitEthernet1/0", "application": "backup", "expected_dscp": "cs0", "observed_dscp": "af21", "vlan": 50, "description": "QoS misclassification on GigabitEthernet1/0: app=backup, expected DSCP=cs0, observed DSCP=af21 (VLAN 50)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "vlan": 50, "expected_dscp": "cs0", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi10", " match vlan 50", "policy-map PM_BRANCH_Gi10", " class CM_BRANCH_Gi10", "  set dscp cs0", "interface GigabitEthernet1/0", " service-policy input PM_BRANCH_Gi10", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T15:32:06.286916Z", "interface": "GigabitEthernet0/0", "class": "BULK", "drop_rate_pct": 40, "current_rate_kbps": 1000, "suggested_rate_kbps": 3000, "reason": "burst too small", "description": "Policing drops on GigabitEthernet0/0 class=BULK. Current rate 1000 kbps; drops due to burst too small."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "class": "BULK", "current_rate_kbps": 1000, "suggested_rate_kbps": 3000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 3000 8000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/0", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T12:43:06.281273Z", "routing_process": "isis", "pid": 4120, "stuck_minutes": 42, "symptom": "RIB update stalled", "description": "Routing process 'isis' appears hung (pid=4120), stuck for ~42 minutes. Symptom: RIB update stalled."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "routing_process": "isis", "pid": 4120, "stuck_minutes": 42}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T16:38:06.285891Z", "interface": "TenGigabitEthernet1/2", "class": "VIDEO", "drop_rate_pct": 38, "current_rate_kbps": 10000, "suggested_rate_kbps": 30000, "reason": "rate too low", "description": "Policing drops on TenGigabitEthernet1/2 class=VIDEO. Current rate 10000 kbps; drops due to rate too low."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "class": "VIDEO", "current_rate_kbps": 10000, "suggested_rate_kbps": 30000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 30000 16000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T18:58:06.280431Z", "routing_process": "bgp", "pid": 4696, "stuck_minutes": 37, "symptom": "Routing table not updating", "description": "Routing process 'bgp' appears hung (pid=4696), stuck for ~37 minutes. Symptom: Routing table not updating."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "routing_process": "bgp", "pid": 4696, "stuck_minutes": 37}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T20:06:06.284540Z", "interface": "TenGigabitEthernet1/2", "application": "video", "expected_dscp": "af21", "observed_dscp": "cs3", "vlan": 30, "description": "QoS misclassification on TenGigabitEthernet1/2: app=video, expected DSCP=af21, observed DSCP=cs3 (VLAN 30)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/2", "vlan": 30, "expected_dscp": "af21", "observed_dscp": "cs3"}], "cli_fix": ["class-map match-any CM_EDGERT_TenGi12", " match vlan 30", "policy-map PM_EDGERT_TenGi12", " class CM_EDGERT_TenGi12", "  set dscp af21", "interface TenGigabitEthernet1/2", " service-policy input PM_EDGERT_TenGi12", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T21:18:06.286195Z", "interface": "TenGigabitEthernet1/2", "class": "BULK", "drop_rate_pct": 7, "current_rate_kbps": 1000, "suggested_rate_kbps": 2000, "reason": "token bucket depleted", "description": "Policing drops on TenGigabitEthernet1/2 class=BULK. Current rate 1000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "class": "BULK", "current_rate_kbps": 1000, "suggested_rate_kbps": 2000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 2000 8000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T14:15:06.282765Z", "interface": "GigabitEthernet1/0", "application": "backup", "expected_dscp": "af31", "observed_dscp": "cs3", "vlan": 40, "description": "QoS misclassification on GigabitEthernet1/0: app=backup, expected DSCP=af31, observed DSCP=cs3 (VLAN 40)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "vlan": 40, "expected_dscp": "af31", "observed_dscp": "cs3"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi10", " match vlan 40", "policy-map PM_BRANCH_Gi10", " class CM_BRANCH_Gi10", "  set dscp af31", "interface GigabitEthernet1/0", " service-policy input PM_BRANCH_Gi10", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T11:47:06.284079Z", "interface": "GigabitEthernet1/0", "application": "video", "expected_dscp": "af21", "observed_dscp": "af31", "vlan": 30, "description": "QoS misclassification on GigabitEthernet1/0: app=video, expected DSCP=af21, observed DSCP=af31 (VLAN 30)."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "vlan": 30, "expected_dscp": "af21", "observed_dscp": "af31"}], "cli_fix": ["class-map match-any CM_DCR1_Gi10", " match vlan 30", "policy-map PM_DCR1_Gi10", " class CM_DCR1_Gi10", "  set dscp af21", "interface GigabitEthernet1/0", " service-policy input PM_DCR1_Gi10", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T19:57:06.280907Z", "routing_process": "bgp", "pid": 4381, "stuck_minutes": 34, "symptom": "Adjacency state not progressing", "description": "Routing process 'bgp' appears hung (pid=4381), stuck for ~34 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "routing_process": "bgp", "pid": 4381, "stuck_minutes": 34}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T13:08:06.279742Z", "routing_process": "eigrp", "pid": 182, "stuck_minutes": 3, "symptom": "BGP scanner unresponsive", "description": "Routing process 'eigrp' appears hung (pid=182), stuck for ~3 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "routing_process": "eigrp", "pid": 182, "stuck_minutes": 3}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T11:47:06.283628Z", "interface": "TenGigabitEthernet1/2", "application": "voice", "expected_dscp": "af31", "observed_dscp": "cs0", "vlan": 40, "description": "QoS misclassification on TenGigabitEthernet1/2: app=voice, expected DSCP=af31, observed DSCP=cs0 (VLAN 40)."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/2", "vlan": 40, "expected_dscp": "af31", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_DCR1_TenGi12", " match vlan 40", "policy-map PM_DCR1_TenGi12", " class CM_DCR1_TenGi12", "  set dscp af31", "interface TenGigabitEthernet1/2", " service-policy input PM_DCR1_TenGi12", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T13:25:06.281476Z", "routing_process": "eigrp", "pid": 1854, "stuck_minutes": 32, "symptom": "Adjacency state not progressing", "description": "Routing process 'eigrp' appears hung (pid=1854), stuck for ~32 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "routing_process": "eigrp", "pid": 1854, "stuck_minutes": 32}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T16:09:06.280222Z", "routing_process": "bgp", "pid": 1635, "stuck_minutes": 42, "symptom": "Adjacency state not progressing", "description": "Routing process 'bgp' appears hung (pid=1635), stuck for ~42 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios_xe", "routing_process": "bgp", "pid": 1635, "stuck_minutes": 42}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:06:06.283211Z", "interface": "GigabitEthernet0/1", "application": "voice", "expected_dscp": "cs3", "observed_dscp": "ef", "vlan": 50, "description": "QoS misclassification on GigabitEthernet0/1: app=voice, expected DSCP=cs3, observed DSCP=ef (VLAN 50)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "vlan": 50, "expected_dscp": "cs3", "observed_dscp": "ef"}], "cli_fix": ["class-map match-any CM_CORER2_Gi01", " match vlan 50", "policy-map PM_CORER2_Gi01", " class CM_CORER2_Gi01", "  set dscp cs3", "interface GigabitEthernet0/1", " service-policy input PM_CORER2_Gi01", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T17:49:06.282679Z", "interface": "GigabitEthernet0/0", "application": "backup", "expected_dscp": "af31", "observed_dscp": "cs3", "vlan": 20, "description": "QoS misclassification on GigabitEthernet0/0: app=backup, expected DSCP=af31, observed DSCP=cs3 (VLAN 20)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "vlan": 20, "expected_dscp": "af31", "observed_dscp": "cs3"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi00", " match vlan 20", "policy-map PM_BRANCH_Gi00", " class CM_BRANCH_Gi00", "  set dscp af31", "interface GigabitEthernet0/0", " service-policy input PM_BRANCH_Gi00", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T20:33:06.285965Z", "interface": "TenGigabitEthernet1/2", "class": "DATA", "drop_rate_pct": 37, "current_rate_kbps": 10000, "suggested_rate_kbps": 30000, "reason": "rate too low", "description": "Policing drops on TenGigabitEthernet1/2 class=DATA. Current rate 10000 kbps; drops due to rate too low."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "class": "DATA", "current_rate_kbps": 10000, "suggested_rate_kbps": 30000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 30000 32000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T16:36:06.283289Z", "interface": "GigabitEthernet1/0", "application": "erp", "expected_dscp": "ef", "observed_dscp": "af41", "vlan": 50, "description": "QoS misclassification on GigabitEthernet1/0: app=erp, expected DSCP=ef, observed DSCP=af41 (VLAN 50)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "vlan": 50, "expected_dscp": "ef", "observed_dscp": "af41"}], "cli_fix": ["class-map match-any CM_CORER1_Gi10", " match vlan 50", "policy-map PM_CORER1_Gi10", " class CM_CORER1_Gi10", "  set dscp ef", "interface GigabitEthernet1/0", " service-policy input PM_CORER1_Gi10", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T17:41:06.281550Z", "routing_process": "isis", "pid": 4987, "stuck_minutes": 17, "symptom": "SPF calculation stuck", "description": "Routing process 'isis' appears hung (pid=4987), stuck for ~17 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "routing_process": "isis", "pid": 4987, "stuck_minutes": 17}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T21:03:06.286679Z", "interface": "GigabitEthernet0/1", "class": "DATA", "drop_rate_pct": 21, "current_rate_kbps": 20000, "suggested_rate_kbps": 40000, "reason": "rate too low", "description": "Policing drops on GigabitEthernet0/1 class=DATA. Current rate 20000 kbps; drops due to rate too low."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "class": "DATA", "current_rate_kbps": 20000, "suggested_rate_kbps": 40000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 40000 8000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T15:38:06.281469Z", "routing_process": "bgp", "pid": 1075, "stuck_minutes": 9, "symptom": "Adjacency state not progressing", "description": "Routing process 'bgp' appears hung (pid=1075), stuck for ~9 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "routing_process": "bgp", "pid": 1075, "stuck_minutes": 9}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T15:05:06.286664Z", "interface": "GigabitEthernet1/0", "class": "VIDEO", "drop_rate_pct": 9, "current_rate_kbps": 2000, "suggested_rate_kbps": 6000, "reason": "token bucket depleted", "description": "Policing drops on GigabitEthernet1/0 class=VIDEO. Current rate 2000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "class": "VIDEO", "current_rate_kbps": 2000, "suggested_rate_kbps": 6000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 6000 8000 conform-action transmit exceed-action drop", "interface GigabitEthernet1/0", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T14:33:06.280739Z", "routing_process": "isis", "pid": 1431, "stuck_minutes": 27, "symptom": "BGP scanner unresponsive", "description": "Routing process 'isis' appears hung (pid=1431), stuck for ~27 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "routing_process": "isis", "pid": 1431, "stuck_minutes": 27}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T14:25:06.279776Z", "routing_process": "eigrp", "pid": 2993, "stuck_minutes": 32, "symptom": "BGP scanner unresponsive", "description": "Routing process 'eigrp' appears hung (pid=2993), stuck for ~32 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "routing_process": "eigrp", "pid": 2993, "stuck_minutes": 32}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T19:01:06.284557Z", "interface": "TenGigabitEthernet1/1", "application": "erp", "expected_dscp": "af21", "observed_dscp": "cs0", "vlan": 50, "description": "QoS misclassification on TenGigabitEthernet1/1: app=erp, expected DSCP=af21, observed DSCP=cs0 (VLAN 50)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "vlan": 50, "expected_dscp": "af21", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_CORER1_TenGi11", " match vlan 50", "policy-map PM_CORER1_TenGi11", " class CM_CORER1_TenGi11", "  set dscp af21", "interface TenGigabitEthernet1/1", " service-policy input PM_CORER1_TenGi11", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T20:48:06.283529Z", "interface": "TenGigabitEthernet1/2", "application": "video", "expected_dscp": "af21", "observed_dscp": "cs0", "vlan": 30, "description": "QoS misclassification on TenGigabitEthernet1/2: app=video, expected DSCP=af21, observed DSCP=cs0 (VLAN 30)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "vlan": 30, "expected_dscp": "af21", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_BRANCH_TenGi12", " match vlan 30", "policy-map PM_BRANCH_TenGi12", " class CM_BRANCH_TenGi12", "  set dscp af21", "interface TenGigabitEthernet1/2", " service-policy input PM_BRANCH_TenGi12", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T12:32:06.285607Z", "interface": "GigabitEthernet0/1", "class": "VOICE", "drop_rate_pct": 19, "current_rate_kbps": 10000, "suggested_rate_kbps": 20000, "reason": "token bucket depleted", "description": "Policing drops on GigabitEthernet0/1 class=VOICE. Current rate 10000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "class": "VOICE", "current_rate_kbps": 10000, "suggested_rate_kbps": 20000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 20000 32000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T14:08:06.281046Z", "routing_process": "bgp", "pid": 696, "stuck_minutes": 22, "symptom": "BGP scanner unresponsive", "description": "Routing process 'bgp' appears hung (pid=696), stuck for ~22 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "routing_process": "bgp", "pid": 696, "stuck_minutes": 22}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T17:27:06.285873Z", "interface": "TenGigabitEthernet1/2", "class": "VIDEO", "drop_rate_pct": 40, "current_rate_kbps": 20000, "suggested_rate_kbps": 40000, "reason": "rate too low", "description": "Policing drops on TenGigabitEthernet1/2 class=VIDEO. Current rate 20000 kbps; drops due to rate too low."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/2", "class": "VIDEO", "current_rate_kbps": 20000, "suggested_rate_kbps": 40000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 40000 16000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T17:10:06.287204Z", "interface": "GigabitEthernet0/1", "class": "DATA", "drop_rate_pct": 15, "current_rate_kbps": 2000, "suggested_rate_kbps": 4000, "reason": "burst too small", "description": "Policing drops on GigabitEthernet0/1 class=DATA. Current rate 2000 kbps; drops due to burst too small."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "class": "DATA", "current_rate_kbps": 2000, "suggested_rate_kbps": 4000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 4000 64000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T18:46:06.280228Z", "routing_process": "ospf", "pid": 429, "stuck_minutes": 17, "symptom": "BGP scanner unresponsive", "description": "Routing process 'ospf' appears hung (pid=429), stuck for ~17 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "routing_process": "ospf", "pid": 429, "stuck_minutes": 17}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T17:52:06.283790Z", "interface": "TenGigabitEthernet1/2", "application": "backup", "expected_dscp": "cs0", "observed_dscp": "af31", "vlan": 20, "description": "QoS misclassification on TenGigabitEthernet1/2: app=backup, expected DSCP=cs0, observed DSCP=af31 (VLAN 20)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "vlan": 20, "expected_dscp": "cs0", "observed_dscp": "af31"}], "cli_fix": ["class-map match-any CM_BRANCH_TenGi12", " match vlan 20", "policy-map PM_BRANCH_TenGi12", " class CM_BRANCH_TenGi12", "  set dscp cs0", "interface TenGigabitEthernet1/2", " service-policy input PM_BRANCH_TenGi12", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T14:58:06.284386Z", "interface": "GigabitEthernet0/1", "application": "voice", "expected_dscp": "af21", "observed_dscp": "af31", "vlan": 20, "description": "QoS misclassification on GigabitEthernet0/1: app=voice, expected DSCP=af21, observed DSCP=af31 (VLAN 20)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "vlan": 20, "expected_dscp": "af21", "observed_dscp": "af31"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi01", " match vlan 20", "policy-map PM_BRANCH_Gi01", " class CM_BRANCH_Gi01", "  set dscp af21", "interface GigabitEthernet0/1", " service-policy input PM_BRANCH_Gi01", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T14:24:06.280944Z", "routing_process": "eigrp", "pid": 4313, "stuck_minutes": 25, "symptom": "BGP scanner unresponsive", "description": "Routing process 'eigrp' appears hung (pid=4313), stuck for ~25 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios_xe", "routing_process": "eigrp", "pid": 4313, "stuck_minutes": 25}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T21:23:06.288085Z", "interface": "TenGigabitEthernet1/1", "class": "VIDEO", "drop_rate_pct": 33, "current_rate_kbps": 2000, "suggested_rate_kbps": 4000, "reason": "rate too low", "description": "Policing drops on TenGigabitEthernet1/1 class=VIDEO. Current rate 2000 kbps; drops due to rate too low."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "class": "VIDEO", "current_rate_kbps": 2000, "suggested_rate_kbps": 4000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 4000 64000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T21:23:06.286105Z", "interface": "GigabitEthernet0/1", "class": "BULK", "drop_rate_pct": 25, "current_rate_kbps": 10000, "suggested_rate_kbps": 30000, "reason": "burst too small", "description": "Policing drops on GigabitEthernet0/1 class=BULK. Current rate 10000 kbps; drops due to burst too small."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "class": "BULK", "current_rate_kbps": 10000, "suggested_rate_kbps": 30000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 30000 32000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T20:08:06.284899Z", "interface": "TenGigabitEthernet1/2", "application": "video", "expected_dscp": "cs3", "observed_dscp": "af41", "vlan": 20, "description": "QoS misclassification on TenGigabitEthernet1/2: app=video, expected DSCP=cs3, observed DSCP=af41 (VLAN 20)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/2", "vlan": 20, "expected_dscp": "cs3", "observed_dscp": "af41"}], "cli_fix": ["class-map match-any CM_EDGERT_TenGi12", " match vlan 20", "policy-map PM_EDGERT_TenGi12", " class CM_EDGERT_TenGi12", "  set dscp cs3", "interface TenGigabitEthernet1/2", " service-policy input PM_EDGERT_TenGi12", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T18:02:06.280629Z", "routing_process": "ospf", "pid": 3012, "stuck_minutes": 36, "symptom": "SPF calculation stuck", "description": "Routing process 'ospf' appears hung (pid=3012), stuck for ~36 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "routing_process": "ospf", "pid": 3012, "stuck_minutes": 36}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T20:47:06.284489Z", "interface": "GigabitEthernet0/1", "application": "backup", "expected_dscp": "ef", "observed_dscp": "cs0", "vlan": 50, "description": "QoS misclassification on GigabitEthernet0/1: app=backup, expected DSCP=ef, observed DSCP=cs0 (VLAN 50)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "vlan": 50, "expected_dscp": "ef", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_CORER2_Gi01", " match vlan 50", "policy-map PM_CORER2_Gi01", " class CM_CORER2_Gi01", "  set dscp ef", "interface GigabitEthernet0/1", " service-policy input PM_CORER2_Gi01", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T14:40:06.284440Z", "interface": "GigabitEthernet0/0", "application": "backup", "expected_dscp": "cs3", "observed_dscp": "af31", "vlan": 40, "description": "QoS misclassification on GigabitEthernet0/0: app=backup, expected DSCP=cs3, observed DSCP=af31 (VLAN 40)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "vlan": 40, "expected_dscp": "cs3", "observed_dscp": "af31"}], "cli_fix": ["class-map match-any CM_CORER1_Gi00", " match vlan 40", "policy-map PM_CORER1_Gi00", " class CM_CORER1_Gi00", "  set dscp cs3", "interface GigabitEthernet0/0", " service-policy input PM_CORER1_Gi00", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T18:29:06.286642Z", "interface": "GigabitEthernet0/0", "class": "BULK", "drop_rate_pct": 21, "current_rate_kbps": 20000, "suggested_rate_kbps": 40000, "reason": "token bucket depleted", "description": "Policing drops on GigabitEthernet0/0 class=BULK. Current rate 20000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "class": "BULK", "current_rate_kbps": 20000, "suggested_rate_kbps": 40000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 40000 32000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/0", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T20:58:06.287484Z", "interface": "GigabitEthernet0/1", "class": "DATA", "drop_rate_pct": 15, "current_rate_kbps": 5000, "suggested_rate_kbps": 15000, "reason": "policer exceed drops", "description": "Policing drops on GigabitEthernet0/1 class=DATA. Current rate 5000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "class": "DATA", "current_rate_kbps": 5000, "suggested_rate_kbps": 15000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 15000 8000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T18:24:06.286090Z", "interface": "TenGigabitEthernet1/2", "class": "VOICE", "drop_rate_pct": 22, "current_rate_kbps": 1000, "suggested_rate_kbps": 2000, "reason": "rate too low", "description": "Policing drops on TenGigabitEthernet1/2 class=VOICE. Current rate 1000 kbps; drops due to rate too low."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "class": "VOICE", "current_rate_kbps": 1000, "suggested_rate_kbps": 2000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 2000 32000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T14:15:06.287775Z", "interface": "GigabitEthernet0/1", "class": "VIDEO", "drop_rate_pct": 11, "current_rate_kbps": 2000, "suggested_rate_kbps": 4000, "reason": "rate too low", "description": "Policing drops on GigabitEthernet0/1 class=VIDEO. Current rate 2000 kbps; drops due to rate too low."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "class": "VIDEO", "current_rate_kbps": 2000, "suggested_rate_kbps": 4000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 4000 8000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T20:47:06.285707Z", "interface": "TenGigabitEthernet1/1", "class": "VOICE", "drop_rate_pct": 25, "current_rate_kbps": 20000, "suggested_rate_kbps": 60000, "reason": "burst too small", "description": "Policing drops on TenGigabitEthernet1/1 class=VOICE. Current rate 20000 kbps; drops due to burst too small."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "class": "VOICE", "current_rate_kbps": 20000, "suggested_rate_kbps": 60000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 60000 64000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T12:28:06.285051Z", "interface": "GigabitEthernet1/0", "application": "voice", "expected_dscp": "cs3", "observed_dscp": "cs0", "vlan": 40, "description": "QoS misclassification on GigabitEthernet1/0: app=voice, expected DSCP=cs3, observed DSCP=cs0 (VLAN 40)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "vlan": 40, "expected_dscp": "cs3", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_CORER2_Gi10", " match vlan 40", "policy-map PM_CORER2_Gi10", " class CM_CORER2_Gi10", "  set dscp cs3", "interface GigabitEthernet1/0", " service-policy input PM_CORER2_Gi10", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T20:49:06.281463Z", "routing_process": "eigrp", "pid": 4307, "stuck_minutes": 39, "symptom": "Routing table not updating", "description": "Routing process 'eigrp' appears hung (pid=4307), stuck for ~39 minutes. Symptom: Routing table not updating."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "routing_process": "eigrp", "pid": 4307, "stuck_minutes": 39}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T21:34:06.279922Z", "routing_process": "eigrp", "pid": 4613, "stuck_minutes": 28, "symptom": "SPF calculation stuck", "description": "Routing process 'eigrp' appears hung (pid=4613), stuck for ~28 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "routing_process": "eigrp", "pid": 4613, "stuck_minutes": 28}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T21:02:06.284108Z", "interface": "GigabitEthernet0/1", "application": "erp", "expected_dscp": "cs3", "observed_dscp": "af21", "vlan": 50, "description": "QoS misclassification on GigabitEthernet0/1: app=erp, expected DSCP=cs3, observed DSCP=af21 (VLAN 50)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "vlan": 50, "expected_dscp": "cs3", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_CORER1_Gi01", " match vlan 50", "policy-map PM_CORER1_Gi01", " class CM_CORER1_Gi01", "  set dscp cs3", "interface GigabitEthernet0/1", " service-policy input PM_CORER1_Gi01", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T14:01:06.281537Z", "routing_process": "isis", "pid": 1363, "stuck_minutes": 9, "symptom": "Routing table not updating", "description": "Routing process 'isis' appears hung (pid=1363), stuck for ~9 minutes. Symptom: Routing table not updating."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios", "routing_process": "isis", "pid": 1363, "stuck_minutes": 9}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T19:31:06.284268Z", "interface": "TenGigabitEthernet1/2", "application": "web", "expected_dscp": "af31", "observed_dscp": "cs0", "vlan": 10, "description": "QoS misclassification on TenGigabitEthernet1/2: app=web, expected DSCP=af31, observed DSCP=cs0 (VLAN 10)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/2", "vlan": 10, "expected_dscp": "af31", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_CORER2_TenGi12", " match vlan 10", "policy-map PM_CORER2_TenGi12", " class CM_CORER2_TenGi12", "  set dscp af31", "interface TenGigabitEthernet1/2", " service-policy input PM_CORER2_TenGi12", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T20:25:06.280727Z", "routing_process": "bgp", "pid": 309, "stuck_minutes": 37, "symptom": "BGP scanner unresponsive", "description": "Routing process 'bgp' appears hung (pid=309), stuck for ~37 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "routing_process": "bgp", "pid": 309, "stuck_minutes": 37}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T17:00:06.282756Z", "interface": "GigabitEthernet1/0", "application": "video", "expected_dscp": "af31", "observed_dscp": "cs3", "vlan": 20, "description": "QoS misclassification on GigabitEthernet1/0: app=video, expected DSCP=af31, observed DSCP=cs3 (VLAN 20)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "vlan": 20, "expected_dscp": "af31", "observed_dscp": "cs3"}], "cli_fix": ["class-map match-any CM_EDGERT_Gi10", " match vlan 20", "policy-map PM_EDGERT_Gi10", " class CM_EDGERT_Gi10", "  set dscp af31", "interface GigabitEthernet1/0", " service-policy input PM_EDGERT_Gi10", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T16:40:06.286423Z", "interface": "GigabitEthernet1/0", "class": "VIDEO", "drop_rate_pct": 14, "current_rate_kbps": 1000, "suggested_rate_kbps": 3000, "reason": "policer exceed drops", "description": "Policing drops on GigabitEthernet1/0 class=VIDEO. Current rate 1000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "class": "VIDEO", "current_rate_kbps": 1000, "suggested_rate_kbps": 3000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 3000 16000 conform-action transmit exceed-action drop", "interface GigabitEthernet1/0", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T13:17:06.285914Z", "interface": "GigabitEthernet0/1", "class": "DATA", "drop_rate_pct": 6, "current_rate_kbps": 10000, "suggested_rate_kbps": 30000, "reason": "rate too low", "description": "Policing drops on GigabitEthernet0/1 class=DATA. Current rate 10000 kbps; drops due to rate too low."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "class": "DATA", "current_rate_kbps": 10000, "suggested_rate_kbps": 30000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 30000 8000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T11:47:06.281637Z", "routing_process": "ospf", "pid": 557, "stuck_minutes": 45, "symptom": "Adjacency state not progressing", "description": "Routing process 'ospf' appears hung (pid=557), stuck for ~45 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "routing_process": "ospf", "pid": 557, "stuck_minutes": 45}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T13:25:06.286923Z", "interface": "TenGigabitEthernet1/1", "class": "VOICE", "drop_rate_pct": 40, "current_rate_kbps": 20000, "suggested_rate_kbps": 60000, "reason": "policer exceed drops", "description": "Policing drops on TenGigabitEthernet1/1 class=VOICE. Current rate 20000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "class": "VOICE", "current_rate_kbps": 20000, "suggested_rate_kbps": 60000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 60000 8000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T21:32:06.280778Z", "routing_process": "eigrp", "pid": 583, "stuck_minutes": 43, "symptom": "Routing table not updating", "description": "Routing process 'eigrp' appears hung (pid=583), stuck for ~43 minutes. Symptom: Routing table not updating."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "routing_process": "eigrp", "pid": 583, "stuck_minutes": 43}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T21:17:06.280707Z", "routing_process": "bgp", "pid": 3904, "stuck_minutes": 37, "symptom": "RIB update stalled", "description": "Routing process 'bgp' appears hung (pid=3904), stuck for ~37 minutes. Symptom: RIB update stalled."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "routing_process": "bgp", "pid": 3904, "stuck_minutes": 37}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T18:54:06.283577Z", "interface": "GigabitEthernet0/0", "application": "voice", "expected_dscp": "ef", "observed_dscp": "cs0", "vlan": 50, "description": "QoS misclassification on GigabitEthernet0/0: app=voice, expected DSCP=ef, observed DSCP=cs0 (VLAN 50)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "vlan": 50, "expected_dscp": "ef", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi00", " match vlan 50", "policy-map PM_BRANCH_Gi00", " class CM_BRANCH_Gi00", "  set dscp ef", "interface GigabitEthernet0/0", " service-policy input PM_BRANCH_Gi00", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T13:07:06.288049Z", "interface": "TenGigabitEthernet1/2", "class": "VIDEO", "drop_rate_pct": 7, "current_rate_kbps": 1000, "suggested_rate_kbps": 2000, "reason": "rate too low", "description": "Policing drops on TenGigabitEthernet1/2 class=VIDEO. Current rate 1000 kbps; drops due to rate too low."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "class": "VIDEO", "current_rate_kbps": 1000, "suggested_rate_kbps": 2000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 2000 32000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T20:23:06.283958Z", "interface": "GigabitEthernet0/0", "application": "backup", "expected_dscp": "cs0", "observed_dscp": "cs3", "vlan": 30, "description": "QoS misclassification on GigabitEthernet0/0: app=backup, expected DSCP=cs0, observed DSCP=cs3 (VLAN 30)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "vlan": 30, "expected_dscp": "cs0", "observed_dscp": "cs3"}], "cli_fix": ["class-map match-any CM_EDGERT_Gi00", " match vlan 30", "policy-map PM_EDGERT_Gi00", " class CM_EDGERT_Gi00", "  set dscp cs0", "interface GigabitEthernet0/0", " service-policy input PM_EDGERT_Gi00", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T12:59:06.284153Z", "interface": "GigabitEthernet0/0", "application": "backup", "expected_dscp": "af41", "observed_dscp": "cs0", "vlan": 10, "description": "QoS misclassification on GigabitEthernet0/0: app=backup, expected DSCP=af41, observed DSCP=cs0 (VLAN 10)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "vlan": 10, "expected_dscp": "af41", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi00", " match vlan 10", "policy-map PM_BRANCH_Gi00", " class CM_BRANCH_Gi00", "  set dscp af41", "interface GigabitEthernet0/0", " service-policy input PM_BRANCH_Gi00", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:38:06.287329Z", "interface": "GigabitEthernet0/1", "class": "VIDEO", "drop_rate_pct": 18, "current_rate_kbps": 5000, "suggested_rate_kbps": 15000, "reason": "rate too low", "description": "Policing drops on GigabitEthernet0/1 class=VIDEO. Current rate 5000 kbps; drops due to rate too low."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "class": "VIDEO", "current_rate_kbps": 5000, "suggested_rate_kbps": 15000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 15000 32000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T17:28:06.287502Z", "interface": "GigabitEthernet1/0", "class": "DATA", "drop_rate_pct": 14, "current_rate_kbps": 20000, "suggested_rate_kbps": 40000, "reason": "rate too low", "description": "Policing drops on GigabitEthernet1/0 class=DATA. Current rate 20000 kbps; drops due to rate too low."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "class": "DATA", "current_rate_kbps": 20000, "suggested_rate_kbps": 40000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 40000 8000 conform-action transmit exceed-action drop", "interface GigabitEthernet1/0", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T19:05:06.279721Z", "routing_process": "bgp", "pid": 3090, "stuck_minutes": 22, "symptom": "SPF calculation stuck", "description": "Routing process 'bgp' appears hung (pid=3090), stuck for ~22 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "routing_process": "bgp", "pid": 3090, "stuck_minutes": 22}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T19:20:06.288120Z", "interface": "GigabitEthernet1/0", "class": "DATA", "drop_rate_pct": 21, "current_rate_kbps": 1000, "suggested_rate_kbps": 2000, "reason": "policer exceed drops", "description": "Policing drops on GigabitEthernet1/0 class=DATA. Current rate 1000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "class": "DATA", "current_rate_kbps": 1000, "suggested_rate_kbps": 2000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 2000 32000 conform-action transmit exceed-action drop", "interface GigabitEthernet1/0", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T20:48:06.280572Z", "routing_process": "bgp", "pid": 532, "stuck_minutes": 23, "symptom": "Adjacency state not progressing", "description": "Routing process 'bgp' appears hung (pid=532), stuck for ~23 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios_xe", "routing_process": "bgp", "pid": 532, "stuck_minutes": 23}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T21:36:06.280796Z", "routing_process": "eigrp", "pid": 4543, "stuck_minutes": 45, "symptom": "BGP scanner unresponsive", "description": "Routing process 'eigrp' appears hung (pid=4543), stuck for ~45 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios_xe", "routing_process": "eigrp", "pid": 4543, "stuck_minutes": 45}], "cli_fix": ["process cpu threshold type total rising 80 interval 5", "process cpu threshold type total falling 60 interval 5"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:23:06.280862Z", "routing_process": "isis", "pid": 4678, "stuck_minutes": 43, "symptom": "BGP scanner unresponsive", "description": "Routing process 'isis' appears hung (pid=4678), stuck for ~43 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "routing_process": "isis", "pid": 4678, "stuck_minutes": 43}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T20:29:06.280931Z", "routing_process": "ospf", "pid": 2538, "stuck_minutes": 20, "symptom": "Routing table not updating", "description": "Routing process 'ospf' appears hung (pid=2538), stuck for ~20 minutes. Symptom: Routing table not updating."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "routing_process": "ospf", "pid": 2538, "stuck_minutes": 20}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T14:56:06.285724Z", "interface": "GigabitEthernet0/1", "class": "DATA", "drop_rate_pct": 30, "current_rate_kbps": 5000, "suggested_rate_kbps": 15000, "reason": "rate too low", "description": "Policing drops on GigabitEthernet0/1 class=DATA. Current rate 5000 kbps; drops due to rate too low."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "class": "DATA", "current_rate_kbps": 5000, "suggested_rate_kbps": 15000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 15000 8000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T18:50:06.281361Z", "routing_process": "isis", "pid": 2775, "stuck_minutes": 4, "symptom": "Routing table not updating", "description": "Routing process 'isis' appears hung (pid=2775), stuck for ~4 minutes. Symptom: Routing table not updating."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "routing_process": "isis", "pid": 2775, "stuck_minutes": 4}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T17:29:06.279982Z", "routing_process": "ospf", "pid": 3098, "stuck_minutes": 40, "symptom": "RIB update stalled", "description": "Routing process 'ospf' appears hung (pid=3098), stuck for ~40 minutes. Symptom: RIB update stalled."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios_xe", "routing_process": "ospf", "pid": 3098, "stuck_minutes": 40}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T17:59:06.284947Z", "interface": "GigabitEthernet0/1", "application": "video", "expected_dscp": "af21", "observed_dscp": "ef", "vlan": 10, "description": "QoS misclassification on GigabitEthernet0/1: app=video, expected DSCP=af21, observed DSCP=ef (VLAN 10)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "vlan": 10, "expected_dscp": "af21", "observed_dscp": "ef"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi01", " match vlan 10", "policy-map PM_BRANCH_Gi01", " class CM_BRANCH_Gi01", "  set dscp af21", "interface GigabitEthernet0/1", " service-policy input PM_BRANCH_Gi01", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:49:06.281387Z", "routing_process": "ospf", "pid": 4730, "stuck_minutes": 9, "symptom": "Adjacency state not progressing", "description": "Routing process 'ospf' appears hung (pid=4730), stuck for ~9 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "routing_process": "ospf", "pid": 4730, "stuck_minutes": 9}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T18:47:06.285004Z", "interface": "GigabitEthernet0/0", "application": "voice", "expected_dscp": "af41", "observed_dscp": "af21", "vlan": 20, "description": "QoS misclassification on GigabitEthernet0/0: app=voice, expected DSCP=af41, observed DSCP=af21 (VLAN 20)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "vlan": 20, "expected_dscp": "af41", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi00", " match vlan 20", "policy-map PM_BRANCH_Gi00", " class CM_BRANCH_Gi00", "  set dscp af41", "interface GigabitEthernet0/0", " service-policy input PM_BRANCH_Gi00", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T13:22:06.279941Z", "routing_process": "eigrp", "pid": 3328, "stuck_minutes": 21, "symptom": "BGP scanner unresponsive", "description": "Routing process 'eigrp' appears hung (pid=3328), stuck for ~21 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "routing_process": "eigrp", "pid": 3328, "stuck_minutes": 21}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T16:58:06.288204Z", "interface": "GigabitEthernet1/0", "class": "VIDEO", "drop_rate_pct": 35, "current_rate_kbps": 10000, "suggested_rate_kbps": 20000, "reason": "burst too small", "description": "Policing drops on GigabitEthernet1/0 class=VIDEO. Current rate 10000 kbps; drops due to burst too small."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "class": "VIDEO", "current_rate_kbps": 10000, "suggested_rate_kbps": 20000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 20000 64000 conform-action transmit exceed-action drop", "interface GigabitEthernet1/0", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T21:34:06.286097Z", "interface": "GigabitEthernet1/0", "class": "BULK", "drop_rate_pct": 14, "current_rate_kbps": 10000, "suggested_rate_kbps": 30000, "reason": "token bucket depleted", "description": "Policing drops on GigabitEthernet1/0 class=BULK. Current rate 10000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "class": "BULK", "current_rate_kbps": 10000, "suggested_rate_kbps": 30000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 30000 64000 conform-action transmit exceed-action drop", "interface GigabitEthernet1/0", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T18:47:06.286203Z", "interface": "TenGigabitEthernet1/2", "class": "BULK", "drop_rate_pct": 38, "current_rate_kbps": 5000, "suggested_rate_kbps": 15000, "reason": "token bucket depleted", "description": "Policing drops on TenGigabitEthernet1/2 class=BULK. Current rate 5000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/2", "class": "BULK", "current_rate_kbps": 5000, "suggested_rate_kbps": 15000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 15000 32000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T21:04:06.287898Z", "interface": "GigabitEthernet0/0", "class": "DATA", "drop_rate_pct": 31, "current_rate_kbps": 10000, "suggested_rate_kbps": 20000, "reason": "policer exceed drops", "description": "Policing drops on GigabitEthernet0/0 class=DATA. Current rate 10000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "class": "DATA", "current_rate_kbps": 10000, "suggested_rate_kbps": 20000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 20000 8000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/0", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T12:27:06.284308Z", "interface": "TenGigabitEthernet1/2", "application": "video", "expected_dscp": "cs3", "observed_dscp": "af31", "vlan": 30, "description": "QoS misclassification on TenGigabitEthernet1/2: app=video, expected DSCP=cs3, observed DSCP=af31 (VLAN 30)."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/2", "vlan": 30, "expected_dscp": "cs3", "observed_dscp": "af31"}], "cli_fix": ["class-map match-any CM_DCR1_TenGi12", " match vlan 30", "policy-map PM_DCR1_TenGi12", " class CM_DCR1_TenGi12", "  set dscp cs3", "interface TenGigabitEthernet1/2", " service-policy input PM_DCR1_TenGi12", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T12:31:06.283361Z", "interface": "GigabitEthernet0/1", "application": "erp", "expected_dscp": "cs0", "observed_dscp": "ef", "vlan": 10, "description": "QoS misclassification on GigabitEthernet0/1: app=erp, expected DSCP=cs0, observed DSCP=ef (VLAN 10)."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "vlan": 10, "expected_dscp": "cs0", "observed_dscp": "ef"}], "cli_fix": ["class-map match-any CM_DCR2_Gi01", " match vlan 10", "policy-map PM_DCR2_Gi01", " class CM_DCR2_Gi01", "  set dscp cs0", "interface GigabitEthernet0/1", " service-policy input PM_DCR2_Gi01", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T13:38:06.280185Z", "routing_process": "isis", "pid": 3895, "stuck_minutes": 38, "symptom": "SPF calculation stuck", "description": "Routing process 'isis' appears hung (pid=3895), stuck for ~38 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "routing_process": "isis", "pid": 3895, "stuck_minutes": 38}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T16:50:06.285185Z", "interface": "TenGigabitEthernet1/2", "application": "web", "expected_dscp": "cs3", "observed_dscp": "af41", "vlan": 10, "description": "QoS misclassification on TenGigabitEthernet1/2: app=web, expected DSCP=cs3, observed DSCP=af41 (VLAN 10)."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/2", "vlan": 10, "expected_dscp": "cs3", "observed_dscp": "af41"}], "cli_fix": ["class-map match-any CM_DCR1_TenGi12", " match vlan 10", "policy-map PM_DCR1_TenGi12", " class CM_DCR1_TenGi12", "  set dscp cs3", "interface TenGigabitEthernet1/2", " service-policy input PM_DCR1_TenGi12", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T16:28:06.280815Z", "routing_process": "isis", "pid": 1608, "stuck_minutes": 10, "symptom": "RIB update stalled", "description": "Routing process 'isis' appears hung (pid=1608), stuck for ~10 minutes. Symptom: RIB update stalled."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "routing_process": "isis", "pid": 1608, "stuck_minutes": 10}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T16:43:06.281028Z", "routing_process": "isis", "pid": 1378, "stuck_minutes": 9, "symptom": "BGP scanner unresponsive", "description": "Routing process 'isis' appears hung (pid=1378), stuck for ~9 minutes. Symptom: BGP scanner unresponsive."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "routing_process": "isis", "pid": 1378, "stuck_minutes": 9}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T13:25:06.280688Z", "routing_process": "bgp", "pid": 1495, "stuck_minutes": 12, "symptom": "SPF calculation stuck", "description": "Routing process 'bgp' appears hung (pid=1495), stuck for ~12 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "routing_process": "bgp", "pid": 1495, "stuck_minutes": 12}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T21:12:06.280450Z", "routing_process": "eigrp", "pid": 2933, "stuck_minutes": 27, "symptom": "RIB update stalled", "description": "Routing process 'eigrp' appears hung (pid=2933), stuck for ~27 minutes. Symptom: RIB update stalled."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "routing_process": "eigrp", "pid": 2933, "stuck_minutes": 27}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T21:15:06.287991Z", "interface": "TenGigabitEthernet1/1", "class": "DATA", "drop_rate_pct": 14, "current_rate_kbps": 1000, "suggested_rate_kbps": 3000, "reason": "policer exceed drops", "description": "Policing drops on TenGigabitEthernet1/1 class=DATA. Current rate 1000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "class": "DATA", "current_rate_kbps": 1000, "suggested_rate_kbps": 3000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 3000 8000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T12:39:06.286366Z", "interface": "TenGigabitEthernet1/1", "class": "DATA", "drop_rate_pct": 30, "current_rate_kbps": 5000, "suggested_rate_kbps": 15000, "reason": "policer exceed drops", "description": "Policing drops on TenGigabitEthernet1/1 class=DATA. Current rate 5000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "class": "DATA", "current_rate_kbps": 5000, "suggested_rate_kbps": 15000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 15000 32000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T13:20:06.282955Z", "interface": "GigabitEthernet0/1", "application": "voice", "expected_dscp": "cs3", "observed_dscp": "af41", "vlan": 50, "description": "QoS misclassification on GigabitEthernet0/1: app=voice, expected DSCP=cs3, observed DSCP=af41 (VLAN 50)."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "vlan": 50, "expected_dscp": "cs3", "observed_dscp": "af41"}], "cli_fix": ["class-map match-any CM_BRANCH_Gi01", " match vlan 50", "policy-map PM_BRANCH_Gi01", " class CM_BRANCH_Gi01", "  set dscp cs3", "interface GigabitEthernet0/1", " service-policy input PM_BRANCH_Gi01", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "DC-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T15:00:06.285213Z", "interface": "GigabitEthernet1/0", "application": "voice", "expected_dscp": "ef", "observed_dscp": "af41", "vlan": 30, "description": "QoS misclassification on GigabitEthernet1/0: app=voice, expected DSCP=ef, observed DSCP=af41 (VLAN 30)."}, "devices": [{"name": "DC-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "vlan": 30, "expected_dscp": "ef", "observed_dscp": "af41"}], "cli_fix": ["class-map match-any CM_DCR2_Gi10", " match vlan 30", "policy-map PM_DCR2_Gi10", " class CM_DCR2_Gi10", "  set dscp ef", "interface GigabitEthernet1/0", " service-policy input PM_DCR2_Gi10", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T17:14:06.286310Z", "interface": "GigabitEthernet0/1", "class": "BULK", "drop_rate_pct": 21, "current_rate_kbps": 1000, "suggested_rate_kbps": 3000, "reason": "policer exceed drops", "description": "Policing drops on GigabitEthernet0/1 class=BULK. Current rate 1000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet0/1", "class": "BULK", "current_rate_kbps": 1000, "suggested_rate_kbps": 3000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 3000 32000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T18:59:06.283703Z", "interface": "GigabitEthernet0/1", "application": "web", "expected_dscp": "cs0", "observed_dscp": "af41", "vlan": 10, "description": "QoS misclassification on GigabitEthernet0/1: app=web, expected DSCP=cs0, observed DSCP=af41 (VLAN 10)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "vlan": 10, "expected_dscp": "cs0", "observed_dscp": "af41"}], "cli_fix": ["class-map match-any CM_EDGERT_Gi01", " match vlan 10", "policy-map PM_EDGERT_Gi01", " class CM_EDGERT_Gi01", "  set dscp cs0", "interface GigabitEthernet0/1", " service-policy input PM_EDGERT_Gi01", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T13:28:06.285466Z", "interface": "GigabitEthernet0/1", "class": "BULK", "drop_rate_pct": 39, "current_rate_kbps": 2000, "suggested_rate_kbps": 4000, "reason": "rate too low", "description": "Policing drops on GigabitEthernet0/1 class=BULK. Current rate 2000 kbps; drops due to rate too low."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/1", "class": "BULK", "current_rate_kbps": 2000, "suggested_rate_kbps": 4000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 4000 32000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/1", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T21:01:06.282807Z", "interface": "TenGigabitEthernet1/2", "application": "web", "expected_dscp": "ef", "observed_dscp": "cs0", "vlan": 10, "description": "QoS misclassification on TenGigabitEthernet1/2: app=web, expected DSCP=ef, observed DSCP=cs0 (VLAN 10)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/2", "vlan": 10, "expected_dscp": "ef", "observed_dscp": "cs0"}], "cli_fix": ["class-map match-any CM_EDGERT_TenGi12", " match vlan 10", "policy-map PM_EDGERT_TenGi12", " class CM_EDGERT_TenGi12", "  set dscp ef", "interface TenGigabitEthernet1/2", " service-policy input PM_EDGERT_TenGi12", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T12:31:06.286474Z", "interface": "TenGigabitEthernet1/1", "class": "VIDEO", "drop_rate_pct": 26, "current_rate_kbps": 5000, "suggested_rate_kbps": 15000, "reason": "policer exceed drops", "description": "Policing drops on TenGigabitEthernet1/1 class=VIDEO. Current rate 5000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "class": "VIDEO", "current_rate_kbps": 5000, "suggested_rate_kbps": 15000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 15000 32000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T13:58:06.288007Z", "interface": "GigabitEthernet1/0", "class": "VIDEO", "drop_rate_pct": 21, "current_rate_kbps": 2000, "suggested_rate_kbps": 6000, "reason": "token bucket depleted", "description": "Policing drops on GigabitEthernet1/0 class=VIDEO. Current rate 2000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "class": "VIDEO", "current_rate_kbps": 2000, "suggested_rate_kbps": 6000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 6000 32000 conform-action transmit exceed-action drop", "interface GigabitEthernet1/0", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T12:04:06.285491Z", "interface": "TenGigabitEthernet1/1", "class": "VIDEO", "drop_rate_pct": 11, "current_rate_kbps": 5000, "suggested_rate_kbps": 10000, "reason": "token bucket depleted", "description": "Policing drops on TenGigabitEthernet1/1 class=VIDEO. Current rate 5000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "interface": "TenGigabitEthernet1/1", "class": "VIDEO", "current_rate_kbps": 5000, "suggested_rate_kbps": 10000}], "cli_fix": ["policy-map PM_POLICE_VIDEO", " class VIDEO", "  police 10000 64000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_VIDEO", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T21:14:06.287477Z", "interface": "TenGigabitEthernet1/1", "class": "DATA", "drop_rate_pct": 24, "current_rate_kbps": 2000, "suggested_rate_kbps": 6000, "reason": "rate too low", "description": "Policing drops on TenGigabitEthernet1/1 class=DATA. Current rate 2000 kbps; drops due to rate too low."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "class": "DATA", "current_rate_kbps": 2000, "suggested_rate_kbps": 6000}], "cli_fix": ["policy-map PM_POLICE_DATA", " class DATA", "  police 6000 8000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/1", " service-policy output PM_POLICE_DATA", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T15:55:06.284362Z", "interface": "GigabitEthernet1/0", "application": "erp", "expected_dscp": "af21", "observed_dscp": "cs3", "vlan": 40, "description": "QoS misclassification on GigabitEthernet1/0: app=erp, expected DSCP=af21, observed DSCP=cs3 (VLAN 40)."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "interface": "GigabitEthernet1/0", "vlan": 40, "expected_dscp": "af21", "observed_dscp": "cs3"}], "cli_fix": ["class-map match-any CM_EDGERT_Gi10", " match vlan 40", "policy-map PM_EDGERT_Gi10", " class CM_EDGERT_Gi10", "  set dscp af21", "interface GigabitEthernet1/0", " service-policy input PM_EDGERT_Gi10", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "DC-R1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T14:06:06.286737Z", "interface": "TenGigabitEthernet1/2", "class": "BULK", "drop_rate_pct": 36, "current_rate_kbps": 1000, "suggested_rate_kbps": 2000, "reason": "burst too small", "description": "Policing drops on TenGigabitEthernet1/2 class=BULK. Current rate 1000 kbps; drops due to burst too small."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/2", "class": "BULK", "current_rate_kbps": 1000, "suggested_rate_kbps": 2000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 2000 64000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R2", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T15:03:06.285434Z", "interface": "TenGigabitEthernet1/2", "class": "VOICE", "drop_rate_pct": 31, "current_rate_kbps": 5000, "suggested_rate_kbps": 15000, "reason": "token bucket depleted", "description": "Policing drops on TenGigabitEthernet1/2 class=VOICE. Current rate 5000 kbps; drops due to token bucket depleted."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/2", "class": "VOICE", "current_rate_kbps": 5000, "suggested_rate_kbps": 15000}], "cli_fix": ["policy-map PM_POLICE_VOICE", " class VOICE", "  police 15000 8000 conform-action transmit exceed-action drop", "interface TenGigabitEthernet1/2", " service-policy output PM_POLICE_VOICE", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "EDGE-RTR1", "severity": "medium", "source": "wazuh-agent", "timestamp": "2026-02-12T16:22:06.285272Z", "interface": "GigabitEthernet1/0", "application": "erp", "expected_dscp": "cs0", "observed_dscp": "af41", "vlan": 10, "description": "QoS misclassification on GigabitEthernet1/0: app=erp, expected DSCP=cs0, observed DSCP=af41 (VLAN 10)."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "interface": "GigabitEthernet1/0", "vlan": 10, "expected_dscp": "cs0", "observed_dscp": "af41"}], "cli_fix": ["class-map match-any CM_EDGERT_Gi10", " match vlan 10", "policy-map PM_EDGERT_Gi10", " class CM_EDGERT_Gi10", "  set dscp cs0", "interface GigabitEthernet1/0", " service-policy input PM_EDGERT_Gi10", " exit"]}
+{"incident_type": "policing_drops", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Policing drops detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T19:50:06.288340Z", "interface": "GigabitEthernet0/0", "class": "BULK", "drop_rate_pct": 15, "current_rate_kbps": 2000, "suggested_rate_kbps": 6000, "reason": "policer exceed drops", "description": "Policing drops on GigabitEthernet0/0 class=BULK. Current rate 2000 kbps; drops due to policer exceed drops."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "interface": "GigabitEthernet0/0", "class": "BULK", "current_rate_kbps": 2000, "suggested_rate_kbps": 6000}], "cli_fix": ["policy-map PM_POLICE_BULK", " class BULK", "  police 6000 16000 conform-action transmit exceed-action drop", "interface GigabitEthernet0/0", " service-policy output PM_POLICE_BULK", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T11:55:06.280242Z", "routing_process": "isis", "pid": 3239, "stuck_minutes": 15, "symptom": "SPF calculation stuck", "description": "Routing process 'isis' appears hung (pid=3239), stuck for ~15 minutes. Symptom: SPF calculation stuck."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios", "routing_process": "isis", "pid": 3239, "stuck_minutes": 15}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:48:06.282503Z", "interface": "TenGigabitEthernet1/2", "application": "video", "expected_dscp": "ef", "observed_dscp": "af21", "vlan": 30, "description": "QoS misclassification on TenGigabitEthernet1/2: app=video, expected DSCP=ef, observed DSCP=af21 (VLAN 30)."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/2", "vlan": 30, "expected_dscp": "ef", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_BRANCH_TenGi12", " match vlan 30", "policy-map PM_BRANCH_TenGi12", " class CM_BRANCH_TenGi12", "  set dscp ef", "interface TenGigabitEthernet1/2", " service-policy input PM_BRANCH_TenGi12", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T20:11:06.284004Z", "interface": "TenGigabitEthernet1/1", "application": "web", "expected_dscp": "ef", "observed_dscp": "af21", "vlan": 40, "description": "QoS misclassification on TenGigabitEthernet1/1: app=web, expected DSCP=ef, observed DSCP=af21 (VLAN 40)."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "interface": "TenGigabitEthernet1/1", "vlan": 40, "expected_dscp": "ef", "observed_dscp": "af21"}], "cli_fix": ["class-map match-any CM_CORER1_TenGi11", " match vlan 40", "policy-map PM_CORER1_TenGi11", " class CM_CORER1_TenGi11", "  set dscp ef", "interface TenGigabitEthernet1/1", " service-policy input PM_CORER1_TenGi11", " exit"]}
+{"incident_type": "qos_misclassification", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "QoS misclassification detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T13:09:06.284014Z", "interface": "GigabitEthernet0/0", "application": "erp", "expected_dscp": "af21", "observed_dscp": "cs3", "vlan": 30, "description": "QoS misclassification on GigabitEthernet0/0: app=erp, expected DSCP=af21, observed DSCP=cs3 (VLAN 30)."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "interface": "GigabitEthernet0/0", "vlan": 30, "expected_dscp": "af21", "observed_dscp": "cs3"}], "cli_fix": ["class-map match-any CM_CORER2_Gi00", " match vlan 30", "policy-map PM_CORER2_Gi00", " class CM_CORER2_Gi00", "  set dscp af21", "interface GigabitEthernet0/0", " service-policy input PM_CORER2_Gi00", " exit"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T16:40:06.280198Z", "routing_process": "eigrp", "pid": 1101, "stuck_minutes": 36, "symptom": "RIB update stalled", "description": "Routing process 'eigrp' appears hung (pid=1101), stuck for ~36 minutes. Symptom: RIB update stalled."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios", "routing_process": "eigrp", "pid": 1101, "stuck_minutes": 36}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-12T21:23:06.280052Z", "routing_process": "isis", "pid": 3351, "stuck_minutes": 21, "symptom": "Adjacency state not progressing", "description": "Routing process 'isis' appears hung (pid=3351), stuck for ~21 minutes. Symptom: Adjacency state not progressing."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "routing_process": "isis", "pid": 3351, "stuck_minutes": 21}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}
+{"incident_type": "route_process_hanging", "instruction": "Analyze routing and QoS incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Route process hanging detected", "device": "DC-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-12T17:20:06.280662Z", "routing_process": "eigrp", "pid": 3796, "stuck_minutes": 17, "symptom": "Routing table not updating", "description": "Routing process 'eigrp' appears hung (pid=3796), stuck for ~17 minutes. Symptom: Routing table not updating."}, "devices": [{"name": "DC-R1", "platform": "cisco_ios_xe", "routing_process": "eigrp", "pid": 3796, "stuck_minutes": 17}], "cli_fix": ["scheduler allocate 20000 1000", "logging buffered 16384 warnings"]}