{"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.131 1 FULL/DR 00:00:33 10.0.3.139 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.196 1 FULL/DR 00:00:33 10.0.3.66 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.189 1 FULL/DR 00:00:33 10.0.3.60 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.55 1 FULL/DR 00:00:33 10.0.2.85 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.226 1 FULL/DR 00:00:33 10.0.5.6 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.246 1 FULL/DR 00:00:33 10.0.4.203 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.72 1 FULL/DR 00:00:33 10.0.3.118 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.0.217) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.217\nAdvertising Router: 10.0.0.217\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.232 1 FULL/DR 00:00:33 10.0.4.221 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.3.65) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.65\nAdvertising Router: 10.0.3.65\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.23 1 FULL/DR 00:00:33 10.0.2.198 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.205 1 FULL/DR 00:00:33 10.0.3.126 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.111 1 FULL/DR 00:00:33 10.0.3.3 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.186 1 FULL/DR 00:00:33 10.0.3.141 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.34 1 FULL/DR 00:00:33 10.0.5.57 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.8 1 FULL/DR 00:00:33 10.0.1.127 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.81 1 FULL/DR 00:00:33 10.0.3.167 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.4.214) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.214\nAdvertising Router: 10.0.4.214\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.223 1 FULL/DR 00:00:33 10.0.4.184 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.143 1 FULL/DR 00:00:33 10.0.3.228 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.47 1 FULL/DR 00:00:33 10.0.4.21 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.145 1 FULL/DR 00:00:33 10.0.2.18 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.45 1 FULL/DR 00:00:33 10.0.4.233 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.11 1 FULL/DR 00:00:33 10.0.1.41 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.204 1 FULL/DR 00:00:33 10.0.1.231 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.163 1 FULL/DR 00:00:33 10.0.2.197 GigabitEthernet0/2\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.36 1 FULL/DR 00:00:33 10.0.1.240 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.201 1 FULL/DR 00:00:33 10.0.4.13 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.74 1 FULL/DR 00:00:33 10.0.2.223 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.71 1 FULL/DR 00:00:33 10.0.3.17 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.180 1 FULL/DR 00:00:33 10.0.3.230 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.111 1 FULL/DR 00:00:33 10.0.5.207 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.102 1 FULL/DR 00:00:33 10.0.2.169 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.50 1 FULL/DR 00:00:33 10.0.5.125 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.48 1 FULL/DR 00:00:33 10.0.3.134 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.132 1 FULL/DR 00:00:33 10.0.5.142 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.121 1 FULL/DR 00:00:33 10.0.2.219 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.98 1 FULL/DR 00:00:33 10.0.3.205 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.200 1 FULL/DR 00:00:33 10.0.4.77 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.235 1 FULL/DR 00:00:33 10.0.3.152 GigabitEthernet0/2\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.87 1 FULL/DR 00:00:33 10.0.1.142 GigabitEthernet0/2\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.186 1 FULL/DR 00:00:33 10.0.3.231 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.175 1 FULL/DR 00:00:33 10.0.5.154 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.156 1 FULL/DR 00:00:33 10.0.3.86 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.60 1 FULL/DR 00:00:33 10.0.1.103 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.75 1 FULL/DR 00:00:33 10.0.1.194 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.208 1 FULL/DR 00:00:33 10.0.1.234 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.246 1 FULL/DR 00:00:33 10.0.1.160 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.47 1 FULL/DR 00:00:33 10.0.1.98 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.5.232) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.5.232\nAdvertising Router: 10.0.5.232\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.184 1 FULL/DR 00:00:33 10.0.2.249 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.237 1 FULL/DR 00:00:33 10.0.2.209 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.160 1 FULL/DR 00:00:33 10.0.4.96 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.46 1 FULL/DR 00:00:33 10.0.1.137 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.210 1 FULL/DR 00:00:33 10.0.4.137 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.193 1 FULL/DR 00:00:33 10.0.4.200 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.121 1 FULL/DR 00:00:33 10.0.5.174 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.227 1 FULL/DR 00:00:33 10.0.1.37 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.114 1 FULL/DR 00:00:33 10.0.1.78 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.38 1 FULL/DR 00:00:33 10.0.3.154 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.102 1 FULL/DR 00:00:33 10.0.1.160 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.94 1 FULL/DR 00:00:33 10.0.5.120 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.157 1 FULL/DR 00:00:33 10.0.5.66 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.50 1 FULL/DR 00:00:33 10.0.2.136 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.29 1 FULL/DR 00:00:33 10.0.1.122 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.228 1 FULL/DR 00:00:33 10.0.2.88 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.168 1 FULL/DR 00:00:33 10.0.5.146 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.114 1 FULL/DR 00:00:33 10.0.2.142 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.32 1 FULL/DR 00:00:33 10.0.2.48 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.53 1 FULL/DR 00:00:33 10.0.5.117 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.51 1 FULL/DR 00:00:33 10.0.4.20 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.209 1 FULL/DR 00:00:33 10.0.1.156 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.140 1 FULL/DR 00:00:33 10.0.3.112 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.91 1 FULL/DR 00:00:33 10.0.1.200 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.147 1 FULL/DR 00:00:33 10.0.5.24 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.52 1 FULL/DR 00:00:33 10.0.1.169 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.249 1 FULL/DR 00:00:33 10.0.4.46 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.9 1 FULL/DR 00:00:33 10.0.3.177 GigabitEthernet0/2\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.69 1 FULL/DR 00:00:33 10.0.2.179 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.234 1 FULL/DR 00:00:33 10.0.4.131 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.188 1 FULL/DR 00:00:33 10.0.3.94 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.127 1 FULL/DR 00:00:33 10.0.5.25 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.68 1 FULL/DR 00:00:33 10.0.3.192 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.13 1 FULL/DR 00:00:33 10.0.5.167 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.151 1 FULL/DR 00:00:33 10.0.5.138 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.63 1 FULL/DR 00:00:33 10.0.2.197 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.51 1 FULL/DR 00:00:33 10.0.3.224 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.4.86) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.86\nAdvertising Router: 10.0.4.86\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.155 1 FULL/DR 00:00:33 10.0.4.159 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.94 1 FULL/DR 00:00:33 10.0.2.104 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.209 1 FULL/DR 00:00:33 10.0.5.156 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.155 1 FULL/DR 00:00:33 10.0.5.39 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.232 1 FULL/DR 00:00:33 10.0.2.229 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.207 1 FULL/DR 00:00:33 10.0.4.184 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.86 1 FULL/DR 00:00:33 10.0.4.172 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.121 1 FULL/DR 00:00:33 10.0.4.64 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.120 1 FULL/DR 00:00:33 10.0.5.139 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.48 1 FULL/DR 00:00:33 10.0.5.129 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.183 1 FULL/DR 00:00:33 10.0.3.126 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.101 1 FULL/DR 00:00:33 10.0.4.170 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.121 1 FULL/DR 00:00:33 10.0.2.87 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.186 1 FULL/DR 00:00:33 10.0.1.227 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.80 1 FULL/DR 00:00:33 10.0.2.26 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.252 1 FULL/DR 00:00:33 10.0.3.183 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.231 1 FULL/DR 00:00:33 10.0.4.75 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.215 1 FULL/DR 00:00:33 10.0.5.241 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.209 1 FULL/DR 00:00:33 10.0.1.70 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.242 1 FULL/DR 00:00:33 10.0.3.74 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.38 1 FULL/DR 00:00:33 10.0.5.175 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.7 1 FULL/DR 00:00:33 10.0.2.177 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.209 1 FULL/DR 00:00:33 10.0.3.233 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.58 1 FULL/DR 00:00:33 10.0.3.77 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.178 1 FULL/DR 00:00:33 10.0.5.45 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.41 1 FULL/DR 00:00:33 10.0.3.157 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.219 1 FULL/DR 00:00:33 10.0.4.226 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.214 1 FULL/DR 00:00:33 10.0.4.164 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.0.66) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.66\nAdvertising Router: 10.0.0.66\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.96 1 FULL/DR 00:00:33 10.0.4.64 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.160 1 FULL/DR 00:00:33 10.0.1.234 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.192 1 FULL/DR 00:00:33 10.0.4.160 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.184 1 FULL/DR 00:00:33 10.0.3.16 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.5.119) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.5.119\nAdvertising Router: 10.0.5.119\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.175 1 FULL/DR 00:00:33 10.0.5.71 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.0.9) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.9\nAdvertising Router: 10.0.0.9\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.223 1 FULL/DR 00:00:33 10.0.2.33 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.218 1 FULL/DR 00:00:33 10.0.2.229 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.119 1 FULL/DR 00:00:33 10.0.2.61 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.20 1 FULL/DR 00:00:33 10.0.1.232 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.52 1 FULL/DR 00:00:33 10.0.5.237 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.225 1 FULL/DR 00:00:33 10.0.1.82 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.35 1 FULL/DR 00:00:33 10.0.4.243 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.187 1 FULL/DR 00:00:33 10.0.1.33 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.208 1 FULL/DR 00:00:33 10.0.5.194 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.232 1 FULL/DR 00:00:33 10.0.5.5 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.123 1 FULL/DR 00:00:33 10.0.1.120 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.61 1 FULL/DR 00:00:33 10.0.1.197 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.0.14) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.14\nAdvertising Router: 10.0.0.14\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.20 1 FULL/DR 00:00:33 10.0.2.59 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.76 1 FULL/DR 00:00:33 10.0.1.71 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.186 1 FULL/DR 00:00:33 10.0.2.63 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.87 1 FULL/DR 00:00:33 10.0.4.59 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.16 1 FULL/DR 00:00:33 10.0.2.49 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.182 1 FULL/DR 00:00:33 10.0.3.52 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.149 1 FULL/DR 00:00:33 10.0.2.65 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.93 1 FULL/DR 00:00:33 10.0.3.226 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.4.101) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.101\nAdvertising Router: 10.0.4.101\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.63 1 FULL/DR 00:00:33 10.0.3.49 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.44 1 FULL/DR 00:00:33 10.0.2.65 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.50 1 FULL/DR 00:00:33 10.0.3.223 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.6 1 FULL/DR 00:00:33 10.0.3.141 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.40 1 FULL/DR 00:00:33 10.0.5.51 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.231 1 FULL/DR 00:00:33 10.0.4.126 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.11 1 FULL/DR 00:00:33 10.0.1.139 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.214 1 FULL/DR 00:00:33 10.0.5.6 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.67 1 FULL/DR 00:00:33 10.0.3.79 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.101 1 FULL/DR 00:00:33 10.0.1.25 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.5.18) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.5.18\nAdvertising Router: 10.0.5.18\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.26 1 FULL/DR 00:00:33 10.0.5.163 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.3.130) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.130\nAdvertising Router: 10.0.3.130\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.230 1 FULL/DR 00:00:33 10.0.1.229 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.2.225) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.225\nAdvertising Router: 10.0.2.225\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.54 1 FULL/DR 00:00:33 10.0.2.243 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.76 1 FULL/DR 00:00:33 10.0.4.211 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.132 1 FULL/DR 00:00:33 10.0.5.217 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.41 1 FULL/DR 00:00:33 10.0.1.96 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.223 1 FULL/DR 00:00:33 10.0.3.231 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.48 1 FULL/DR 00:00:33 10.0.5.132 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.54 1 FULL/DR 00:00:33 10.0.5.37 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.0.75) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.75\nAdvertising Router: 10.0.0.75\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.176 1 FULL/DR 00:00:33 10.0.2.153 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.78 1 FULL/DR 00:00:33 10.0.3.28 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.22 1 FULL/DR 00:00:33 10.0.2.160 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.210 1 FULL/DR 00:00:33 10.0.5.237 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.79 1 FULL/DR 00:00:33 10.0.5.65 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.222 1 FULL/DR 00:00:33 10.0.1.47 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.158 1 FULL/DR 00:00:33 10.0.5.17 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.112 1 FULL/DR 00:00:33 10.0.5.28 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.126 1 FULL/DR 00:00:33 10.0.4.68 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.214 1 FULL/DR 00:00:33 10.0.5.16 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.4.220) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.220\nAdvertising Router: 10.0.4.220\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.61 1 FULL/DR 00:00:33 10.0.5.142 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.239 1 FULL/DR 00:00:33 10.0.5.71 GigabitEthernet0/2\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.139 1 FULL/DR 00:00:33 10.0.5.7 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.195 1 FULL/DR 00:00:33 10.0.2.46 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.40 1 FULL/DR 00:00:33 10.0.3.251 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.82 1 FULL/DR 00:00:33 10.0.2.98 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.3.140) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.140\nAdvertising Router: 10.0.3.140\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.227 1 FULL/DR 00:00:33 10.0.2.239 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.27 1 FULL/DR 00:00:33 10.0.4.64 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.40 1 FULL/DR 00:00:33 10.0.4.122 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.66 1 FULL/DR 00:00:33 10.0.1.37 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.198 1 FULL/DR 00:00:33 10.0.2.17 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.59 1 FULL/DR 00:00:33 10.0.5.240 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.115 1 FULL/DR 00:00:33 10.0.2.196 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.231 1 FULL/DR 00:00:33 10.0.5.227 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.4.23) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.23\nAdvertising Router: 10.0.4.23\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.9 1 FULL/DR 00:00:33 10.0.5.59 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.182 1 FULL/DR 00:00:33 10.0.2.220 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.5.168) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.5.168\nAdvertising Router: 10.0.5.168\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.33 1 FULL/DR 00:00:33 10.0.4.132 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.138 1 FULL/DR 00:00:33 10.0.2.159 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.208 1 FULL/DR 00:00:33 10.0.2.151 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.184 1 FULL/DR 00:00:33 10.0.5.190 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.119 1 FULL/DR 00:00:33 10.0.3.207 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.4.154) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.154\nAdvertising Router: 10.0.4.154\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.123 1 FULL/DR 00:00:33 10.0.1.153 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.185 1 FULL/DR 00:00:33 10.0.4.139 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.27 1 FULL/DR 00:00:33 10.0.4.130 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.197 1 FULL/DR 00:00:33 10.0.3.76 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.211 1 FULL/DR 00:00:33 10.0.3.115 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.8 1 FULL/DR 00:00:33 10.0.3.77 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.24 1 FULL/DR 00:00:33 10.0.3.87 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.229 1 FULL/DR 00:00:33 10.0.1.109 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.90 1 FULL/DR 00:00:33 10.0.1.153 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.68 1 FULL/DR 00:00:33 10.0.3.180 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.34 1 FULL/DR 00:00:33 10.0.3.104 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.67 1 FULL/DR 00:00:33 10.0.3.174 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.165 1 FULL/DR 00:00:33 10.0.1.198 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.124 1 FULL/DR 00:00:33 10.0.5.26 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.68 1 FULL/DR 00:00:33 10.0.5.41 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.234 1 FULL/DR 00:00:33 10.0.2.99 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.131 1 FULL/DR 00:00:33 10.0.4.130 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.208 1 FULL/DR 00:00:33 10.0.1.225 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.36 1 FULL/DR 00:00:33 10.0.5.191 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.80 1 FULL/DR 00:00:33 10.0.1.197 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.89 1 FULL/DR 00:00:33 10.0.3.106 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.254 1 FULL/DR 00:00:33 10.0.4.207 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.141 1 FULL/DR 00:00:33 10.0.1.106 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.144 1 FULL/DR 00:00:33 10.0.5.141 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.188 1 FULL/DR 00:00:33 10.0.3.246 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.52 1 FULL/DR 00:00:33 10.0.2.157 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.155 1 FULL/DR 00:00:33 10.0.3.158 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.173 1 FULL/DR 00:00:33 10.0.5.155 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.194 1 FULL/DR 00:00:33 10.0.4.48 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.117 1 FULL/DR 00:00:33 10.0.4.58 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.156 1 FULL/DR 00:00:33 10.0.3.132 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.106 1 FULL/DR 00:00:33 10.0.5.101 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.126 1 FULL/DR 00:00:33 10.0.4.61 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.57 1 FULL/DR 00:00:33 10.0.2.84 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.243 1 FULL/DR 00:00:33 10.0.1.128 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.158 1 FULL/DR 00:00:33 10.0.3.135 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.104 1 FULL/DR 00:00:33 10.0.1.161 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.164 1 FULL/DR 00:00:33 10.0.5.224 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.4.140) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.140\nAdvertising Router: 10.0.4.140\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.235 1 FULL/DR 00:00:33 10.0.2.226 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.33 1 FULL/DR 00:00:33 10.0.2.209 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.0.182) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.182\nAdvertising Router: 10.0.0.182\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.33 1 FULL/DR 00:00:33 10.0.3.89 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.44 1 FULL/DR 00:00:33 10.0.3.114 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.10 1 FULL/DR 00:00:33 10.0.5.72 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.146 1 FULL/DR 00:00:33 10.0.1.47 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.75 1 FULL/DR 00:00:33 10.0.1.241 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.153 1 FULL/DR 00:00:33 10.0.4.220 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.125 1 FULL/DR 00:00:33 10.0.2.140 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.142 1 FULL/DR 00:00:33 10.0.2.18 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.173 1 FULL/DR 00:00:33 10.0.3.22 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.158 1 FULL/DR 00:00:33 10.0.1.215 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.191 1 FULL/DR 00:00:33 10.0.5.242 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.0.106) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.106\nAdvertising Router: 10.0.0.106\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.116 1 FULL/DR 00:00:33 10.0.1.71 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.97 1 FULL/DR 00:00:33 10.0.1.89 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.165 1 FULL/DR 00:00:33 10.0.1.245 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.167 1 FULL/DR 00:00:33 10.0.4.216 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.208 1 FULL/DR 00:00:33 10.0.2.24 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.146 1 FULL/DR 00:00:33 10.0.1.27 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.114 1 FULL/DR 00:00:33 10.0.2.36 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.180 1 FULL/DR 00:00:33 10.0.2.248 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.207 1 FULL/DR 00:00:33 10.0.1.43 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.174 1 FULL/DR 00:00:33 10.0.3.252 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.86 1 FULL/DR 00:00:33 10.0.2.186 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.126 1 FULL/DR 00:00:33 10.0.1.220 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.165 1 FULL/DR 00:00:33 10.0.3.87 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.159 1 FULL/DR 00:00:33 10.0.2.197 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.59 1 FULL/DR 00:00:33 10.0.4.86 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.91 1 FULL/DR 00:00:33 10.0.3.153 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.1 1 FULL/DR 00:00:33 10.0.3.249 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.193 1 FULL/DR 00:00:33 10.0.1.122 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.98 1 FULL/DR 00:00:33 10.0.4.210 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.61 1 FULL/DR 00:00:33 10.0.1.146 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.247 1 FULL/DR 00:00:33 10.0.5.152 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.250 1 FULL/DR 00:00:33 10.0.5.69 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.115 1 FULL/DR 00:00:33 10.0.3.156 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.75 1 FULL/DR 00:00:33 10.0.5.74 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.71 1 FULL/DR 00:00:33 10.0.5.14 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.50 1 FULL/DR 00:00:33 10.0.2.14 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.91 1 FULL/DR 00:00:33 10.0.4.188 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.72 1 FULL/DR 00:00:33 10.0.2.51 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.198 1 FULL/DR 00:00:33 10.0.5.233 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.63 1 FULL/DR 00:00:33 10.0.3.143 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.227 1 FULL/DR 00:00:33 10.0.1.5 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.177 1 FULL/DR 00:00:33 10.0.5.148 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.147 1 FULL/DR 00:00:33 10.0.5.98 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.52 1 FULL/DR 00:00:33 10.0.5.137 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.6 1 FULL/DR 00:00:33 10.0.2.121 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.133 1 FULL/DR 00:00:33 10.0.3.208 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.5.198) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.5.198\nAdvertising Router: 10.0.5.198\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.90 1 FULL/DR 00:00:33 10.0.3.140 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.21 1 FULL/DR 00:00:33 10.0.2.239 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.94 1 FULL/DR 00:00:33 10.0.5.161 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.103 1 FULL/DR 00:00:33 10.0.4.203 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.171 1 FULL/DR 00:00:33 10.0.2.228 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.215 1 FULL/DR 00:00:33 10.0.5.208 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.34 1 FULL/DR 00:00:33 10.0.4.104 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.155 1 FULL/DR 00:00:33 10.0.1.21 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.90 1 FULL/DR 00:00:33 10.0.5.245 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.116 1 FULL/DR 00:00:33 10.0.1.229 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.113 1 FULL/DR 00:00:33 10.0.3.185 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.127 1 FULL/DR 00:00:33 10.0.1.232 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.2.132) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.132\nAdvertising Router: 10.0.2.132\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.199 1 FULL/DR 00:00:33 10.0.5.217 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.88 1 FULL/DR 00:00:33 10.0.3.106 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.45 1 FULL/DR 00:00:33 10.0.2.55 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.110 1 FULL/DR 00:00:33 10.0.5.73 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.147 1 FULL/DR 00:00:33 10.0.2.162 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.218 1 FULL/DR 00:00:33 10.0.1.48 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.202 1 FULL/DR 00:00:33 10.0.2.17 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.231 1 FULL/DR 00:00:33 10.0.1.242 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.223 1 FULL/DR 00:00:33 10.0.2.142 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.5.16) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.5.16\nAdvertising Router: 10.0.5.16\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.105 1 FULL/DR 00:00:33 10.0.2.225 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.16 1 FULL/DR 00:00:33 10.0.2.246 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.188 1 FULL/DR 00:00:33 10.0.1.82 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.38 1 FULL/DR 00:00:33 10.0.3.147 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.153 1 FULL/DR 00:00:33 10.0.4.66 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.47 1 FULL/DR 00:00:33 10.0.1.215 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.2.79) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.79\nAdvertising Router: 10.0.2.79\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.39 1 FULL/DR 00:00:33 10.0.3.239 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.69 1 FULL/DR 00:00:33 10.0.4.102 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.63 1 FULL/DR 00:00:33 10.0.1.155 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.227 1 FULL/DR 00:00:33 10.0.5.187 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.159 1 FULL/DR 00:00:33 10.0.5.240 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.134 1 FULL/DR 00:00:33 10.0.4.248 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.2 1 FULL/DR 00:00:33 10.0.5.37 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.52 1 FULL/DR 00:00:33 10.0.4.12 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.52 1 FULL/DR 00:00:33 10.0.5.126 GigabitEthernet0/2\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.136 1 FULL/DR 00:00:33 10.0.2.94 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.144 1 FULL/DR 00:00:33 10.0.1.49 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.237 1 FULL/DR 00:00:33 10.0.4.129 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.28 1 FULL/DR 00:00:33 10.0.1.121 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.31 1 FULL/DR 00:00:33 10.0.5.241 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.178 1 FULL/DR 00:00:33 10.0.5.97 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.203 1 FULL/DR 00:00:33 10.0.5.46 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.246 1 FULL/DR 00:00:33 10.0.2.44 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.188 1 FULL/DR 00:00:33 10.0.4.87 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.92 1 FULL/DR 00:00:33 10.0.1.176 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.107 1 FULL/DR 00:00:33 10.0.1.93 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.22 1 FULL/DR 00:00:33 10.0.4.217 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.225 1 FULL/DR 00:00:33 10.0.3.179 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.183 1 FULL/DR 00:00:33 10.0.1.31 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.192 1 FULL/DR 00:00:33 10.0.4.92 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.165 1 FULL/DR 00:00:33 10.0.5.232 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.174 1 FULL/DR 00:00:33 10.0.2.10 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.65 1 FULL/DR 00:00:33 10.0.1.196 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.151 1 FULL/DR 00:00:33 10.0.4.112 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.76 1 FULL/DR 00:00:33 10.0.1.117 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.16 1 FULL/DR 00:00:33 10.0.3.122 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.4 1 FULL/DR 00:00:33 10.0.5.180 GigabitEthernet0/2\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.128 1 FULL/DR 00:00:33 10.0.1.157 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.134 1 FULL/DR 00:00:33 10.0.4.160 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.218 1 FULL/DR 00:00:33 10.0.3.91 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.2.248) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.248\nAdvertising Router: 10.0.2.248\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.135 1 FULL/DR 00:00:33 10.0.3.252 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.15 1 FULL/DR 00:00:33 10.0.5.150 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.29 1 FULL/DR 00:00:33 10.0.3.166 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.63 1 FULL/DR 00:00:33 10.0.3.25 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.47 1 FULL/DR 00:00:33 10.0.1.37 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.231 1 FULL/DR 00:00:33 10.0.3.172 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.21 1 FULL/DR 00:00:33 10.0.1.211 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.0.134) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.134\nAdvertising Router: 10.0.0.134\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.39 1 FULL/DR 00:00:33 10.0.1.239 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.108 1 FULL/DR 00:00:33 10.0.3.241 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.236 1 FULL/DR 00:00:33 10.0.5.99 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.242 1 FULL/DR 00:00:33 10.0.3.13 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.46 1 FULL/DR 00:00:33 10.0.1.10 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.103 1 FULL/DR 00:00:33 10.0.5.14 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.156 1 FULL/DR 00:00:33 10.0.1.200 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.30 1 FULL/DR 00:00:33 10.0.5.54 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.171 1 FULL/DR 00:00:33 10.0.5.196 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.105 1 FULL/DR 00:00:33 10.0.1.76 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.152 1 FULL/DR 00:00:33 10.0.3.181 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.41 1 FULL/DR 00:00:33 10.0.4.106 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.135 1 FULL/DR 00:00:33 10.0.1.8 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.4.122) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.122\nAdvertising Router: 10.0.4.122\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.138 1 FULL/DR 00:00:33 10.0.4.250 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.80 1 FULL/DR 00:00:33 10.0.5.22 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.165 1 FULL/DR 00:00:33 10.0.5.219 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.46 1 FULL/DR 00:00:33 10.0.5.71 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.151 1 FULL/DR 00:00:33 10.0.3.198 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.3.205) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.205\nAdvertising Router: 10.0.3.205\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.110 1 FULL/DR 00:00:33 10.0.2.22 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.245 1 FULL/DR 00:00:33 10.0.1.79 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.190 1 FULL/DR 00:00:33 10.0.4.138 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.2.92) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.92\nAdvertising Router: 10.0.2.92\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.108 1 FULL/DR 00:00:33 10.0.5.112 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.34 1 FULL/DR 00:00:33 10.0.5.245 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.60 1 FULL/DR 00:00:33 10.0.5.174 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.205 1 FULL/DR 00:00:33 10.0.2.238 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.12 1 FULL/DR 00:00:33 10.0.3.226 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.150 1 FULL/DR 00:00:33 10.0.2.172 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.0.71) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.71\nAdvertising Router: 10.0.0.71\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.76 1 FULL/DR 00:00:33 10.0.1.216 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.201 1 FULL/DR 00:00:33 10.0.1.5 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.163 1 FULL/DR 00:00:33 10.0.4.137 GigabitEthernet0/2\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.245 1 FULL/DR 00:00:33 10.0.1.221 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.154 1 FULL/DR 00:00:33 10.0.3.202 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.240 1 FULL/DR 00:00:33 10.0.5.153 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.82 1 FULL/DR 00:00:33 10.0.3.224 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.9 1 FULL/DR 00:00:33 10.0.3.150 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.26 1 FULL/DR 00:00:33 10.0.3.243 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.244 1 FULL/DR 00:00:33 10.0.3.196 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.2.211) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.211\nAdvertising Router: 10.0.2.211\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.167 1 FULL/DR 00:00:33 10.0.4.62 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.38 1 FULL/DR 00:00:33 10.0.5.51 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.1 1 FULL/DR 00:00:33 10.0.3.185 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.141 1 FULL/DR 00:00:33 10.0.2.170 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.2.116) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.116\nAdvertising Router: 10.0.2.116\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.219 1 FULL/DR 00:00:33 10.0.4.118 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.181 1 FULL/DR 00:00:33 10.0.2.237 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.70 1 FULL/DR 00:00:33 10.0.5.213 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.88 1 FULL/DR 00:00:33 10.0.1.182 GigabitEthernet0/2\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.171 1 FULL/DR 00:00:33 10.0.1.21 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.196 1 FULL/DR 00:00:33 10.0.3.164 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.4.41) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.41\nAdvertising Router: 10.0.4.41\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.217 1 FULL/DR 00:00:33 10.0.3.63 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.29 1 FULL/DR 00:00:33 10.0.1.167 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.224 1 FULL/DR 00:00:33 10.0.5.251 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.169 1 FULL/DR 00:00:33 10.0.3.119 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.48 1 FULL/DR 00:00:33 10.0.5.206 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.221 1 FULL/DR 00:00:33 10.0.4.234 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.178 1 FULL/DR 00:00:33 10.0.2.248 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.157 1 FULL/DR 00:00:33 10.0.1.84 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.98 1 FULL/DR 00:00:33 10.0.1.117 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.25 1 FULL/DR 00:00:33 10.0.1.222 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.42 1 FULL/DR 00:00:33 10.0.3.58 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.164 1 FULL/DR 00:00:33 10.0.5.67 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.94 1 FULL/DR 00:00:33 10.0.1.135 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.1.35) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.35\nAdvertising Router: 10.0.1.35\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.40 1 FULL/DR 00:00:33 10.0.5.182 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.1 1 FULL/DR 00:00:33 10.0.5.149 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.138 1 FULL/DR 00:00:33 10.0.2.5 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.69 1 FULL/DR 00:00:33 10.0.5.83 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.137 1 FULL/DR 00:00:33 10.0.5.10 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.83 1 FULL/DR 00:00:33 10.0.4.120 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.230 1 FULL/DR 00:00:33 10.0.1.204 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.145 1 FULL/DR 00:00:33 10.0.4.139 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.227 1 FULL/DR 00:00:33 10.0.5.152 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.199 1 FULL/DR 00:00:33 10.0.5.251 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.231 1 FULL/DR 00:00:33 10.0.1.137 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.233 1 FULL/DR 00:00:33 10.0.5.178 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.2 1 FULL/DR 00:00:33 10.0.5.75 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.63 1 FULL/DR 00:00:33 10.0.4.248 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.46 1 FULL/DR 00:00:33 10.0.2.32 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.46 1 FULL/DR 00:00:33 10.0.2.9 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.14 1 FULL/DR 00:00:33 10.0.5.178 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.79 1 FULL/DR 00:00:33 10.0.5.195 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.231 1 FULL/DR 00:00:33 10.0.3.15 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.1 1 FULL/DR 00:00:33 10.0.4.47 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.220 1 FULL/DR 00:00:33 10.0.4.244 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.3 1 FULL/DR 00:00:33 10.0.1.110 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.203 1 FULL/DR 00:00:33 10.0.2.217 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.217 1 FULL/DR 00:00:33 10.0.4.94 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.80 1 FULL/DR 00:00:33 10.0.4.161 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.175 1 FULL/DR 00:00:33 10.0.5.172 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.51 1 FULL/DR 00:00:33 10.0.3.154 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.173 1 FULL/DR 00:00:33 10.0.2.146 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.104 1 FULL/DR 00:00:33 10.0.1.77 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.194 1 FULL/DR 00:00:33 10.0.3.60 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.141 1 FULL/DR 00:00:33 10.0.1.5 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.62 1 FULL/DR 00:00:33 10.0.3.111 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.3 1 FULL/DR 00:00:33 10.0.4.139 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.19 1 FULL/DR 00:00:33 10.0.1.60 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.247 1 FULL/DR 00:00:33 10.0.2.33 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.1.51) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.51\nAdvertising Router: 10.0.1.51\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.119 1 FULL/DR 00:00:33 10.0.4.127 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.89 1 FULL/DR 00:00:33 10.0.5.111 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.27 1 FULL/DR 00:00:33 10.0.5.248 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.171 1 FULL/DR 00:00:33 10.0.3.197 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.253 1 FULL/DR 00:00:33 10.0.4.98 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.2.58) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.58\nAdvertising Router: 10.0.2.58\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.164 1 FULL/DR 00:00:33 10.0.5.75 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.111 1 FULL/DR 00:00:33 10.0.2.82 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.139 1 FULL/DR 00:00:33 10.0.5.155 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.114 1 FULL/DR 00:00:33 10.0.4.240 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.134 1 FULL/DR 00:00:33 10.0.1.227 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.241 1 FULL/DR 00:00:33 10.0.2.54 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.4.251) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.251\nAdvertising Router: 10.0.4.251\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.7 1 FULL/DR 00:00:33 10.0.3.73 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.86 1 FULL/DR 00:00:33 10.0.2.241 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.30 1 FULL/DR 00:00:33 10.0.5.81 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.189 1 FULL/DR 00:00:33 10.0.3.176 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.211 1 FULL/DR 00:00:33 10.0.5.64 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.2 1 FULL/DR 00:00:33 10.0.5.234 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.3.14) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.14\nAdvertising Router: 10.0.3.14\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.60 1 FULL/DR 00:00:33 10.0.2.188 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.218 1 FULL/DR 00:00:33 10.0.3.193 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.39 1 FULL/DR 00:00:33 10.0.1.248 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.144 1 FULL/DR 00:00:33 10.0.1.116 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.0.192) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.192\nAdvertising Router: 10.0.0.192\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.246 1 FULL/DR 00:00:33 10.0.2.111 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.108 1 FULL/DR 00:00:33 10.0.2.183 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.52 1 FULL/DR 00:00:33 10.0.1.24 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.140 1 FULL/DR 00:00:33 10.0.3.212 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.1.27) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.27\nAdvertising Router: 10.0.1.27\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.217 1 FULL/DR 00:00:33 10.0.5.157 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.17 1 FULL/DR 00:00:33 10.0.1.98 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.63 1 FULL/DR 00:00:33 10.0.5.208 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.130 1 FULL/DR 00:00:33 10.0.4.92 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.128 1 FULL/DR 00:00:33 10.0.4.243 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.229 1 FULL/DR 00:00:33 10.0.1.220 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.48 1 FULL/DR 00:00:33 10.0.5.135 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.85 1 FULL/DR 00:00:33 10.0.5.179 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.35 1 FULL/DR 00:00:33 10.0.3.228 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.152 1 FULL/DR 00:00:33 10.0.2.56 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.198 1 FULL/DR 00:00:33 10.0.1.135 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.63 1 FULL/DR 00:00:33 10.0.1.98 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.38 1 FULL/DR 00:00:33 10.0.5.33 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.64 1 FULL/DR 00:00:33 10.0.3.65 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.164 1 FULL/DR 00:00:33 10.0.2.136 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.39 1 FULL/DR 00:00:33 10.0.1.236 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.40 1 FULL/DR 00:00:33 10.0.1.36 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.3.38) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.38\nAdvertising Router: 10.0.3.38\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.254 1 FULL/DR 00:00:33 10.0.5.22 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.4.197) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.197\nAdvertising Router: 10.0.4.197\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.8 1 FULL/DR 00:00:33 10.0.2.100 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.128 1 FULL/DR 00:00:33 10.0.5.249 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.0.135) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.135\nAdvertising Router: 10.0.0.135\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.192 1 FULL/DR 00:00:33 10.0.5.14 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.160 1 FULL/DR 00:00:33 10.0.1.92 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.195 1 FULL/DR 00:00:33 10.0.1.91 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.29 1 FULL/DR 00:00:33 10.0.5.90 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.77 1 FULL/DR 00:00:33 10.0.4.200 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.11 1 FULL/DR 00:00:33 10.0.3.175 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.223 1 FULL/DR 00:00:33 10.0.4.153 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.119 1 FULL/DR 00:00:33 10.0.1.167 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.60 1 FULL/DR 00:00:33 10.0.4.86 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.121 1 FULL/DR 00:00:33 10.0.3.151 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.184 1 FULL/DR 00:00:33 10.0.4.14 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.167 1 FULL/DR 00:00:33 10.0.5.18 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.224 1 FULL/DR 00:00:33 10.0.4.167 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.246 1 FULL/DR 00:00:33 10.0.3.112 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.230 1 FULL/DR 00:00:33 10.0.3.16 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.36 1 FULL/DR 00:00:33 10.0.3.107 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.110 1 FULL/DR 00:00:33 10.0.5.143 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.219 1 FULL/DR 00:00:33 10.0.1.5 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.191 1 FULL/DR 00:00:33 10.0.5.20 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.236 1 FULL/DR 00:00:33 10.0.3.150 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.1.152) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.152\nAdvertising Router: 10.0.1.152\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.2 1 FULL/DR 00:00:33 10.0.3.201 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.169 1 FULL/DR 00:00:33 10.0.4.144 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.179 1 FULL/DR 00:00:33 10.0.1.230 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.114 1 FULL/DR 00:00:33 10.0.5.205 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.219 1 FULL/DR 00:00:33 10.0.2.36 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.167 1 FULL/DR 00:00:33 10.0.4.38 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.174 1 FULL/DR 00:00:33 10.0.5.206 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.158 1 FULL/DR 00:00:33 10.0.5.174 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.132 1 FULL/DR 00:00:33 10.0.4.160 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.133 1 FULL/DR 00:00:33 10.0.5.212 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.154 1 FULL/DR 00:00:33 10.0.4.74 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.112 1 FULL/DR 00:00:33 10.0.5.220 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.38 1 FULL/DR 00:00:33 10.0.5.150 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.240 1 FULL/DR 00:00:33 10.0.2.78 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.24 1 FULL/DR 00:00:33 10.0.2.83 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.79 1 FULL/DR 00:00:33 10.0.3.232 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.111 1 FULL/DR 00:00:33 10.0.2.123 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.230 1 FULL/DR 00:00:33 10.0.3.147 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.71 1 FULL/DR 00:00:33 10.0.5.222 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.124 1 FULL/DR 00:00:33 10.0.2.164 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.177 1 FULL/DR 00:00:33 10.0.3.69 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.157 1 FULL/DR 00:00:33 10.0.4.185 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.124 1 FULL/DR 00:00:33 10.0.2.47 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.1.143) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.143\nAdvertising Router: 10.0.1.143\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.222 1 FULL/DR 00:00:33 10.0.5.128 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.5.172) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.5.172\nAdvertising Router: 10.0.5.172\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.36 1 FULL/DR 00:00:33 10.0.4.96 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.32 1 FULL/DR 00:00:33 10.0.1.137 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.107 1 FULL/DR 00:00:33 10.0.4.92 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.157 1 FULL/DR 00:00:33 10.0.2.213 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.193 1 FULL/DR 00:00:33 10.0.5.142 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.50 1 FULL/DR 00:00:33 10.0.3.170 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.2.190) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.190\nAdvertising Router: 10.0.2.190\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.96 1 FULL/DR 00:00:33 10.0.2.194 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.35 1 FULL/DR 00:00:33 10.0.2.26 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.151 1 FULL/DR 00:00:33 10.0.1.84 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.1.133) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.133\nAdvertising Router: 10.0.1.133\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.47 1 FULL/DR 00:00:33 10.0.3.208 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.197 1 FULL/DR 00:00:33 10.0.4.185 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.121 1 FULL/DR 00:00:33 10.0.3.58 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.211 1 FULL/DR 00:00:33 10.0.1.176 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.74 1 FULL/DR 00:00:33 10.0.4.138 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.248 1 FULL/DR 00:00:33 10.0.5.2 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.55 1 FULL/DR 00:00:33 10.0.1.4 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.65 1 FULL/DR 00:00:33 10.0.5.65 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.190 1 FULL/DR 00:00:33 10.0.3.174 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.168 1 FULL/DR 00:00:33 10.0.1.202 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.236 1 FULL/DR 00:00:33 10.0.4.21 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.5.47) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.5.47\nAdvertising Router: 10.0.5.47\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.226 1 FULL/DR 00:00:33 10.0.5.103 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.73 1 FULL/DR 00:00:33 10.0.4.31 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.78 1 FULL/DR 00:00:33 10.0.2.179 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.188 1 FULL/DR 00:00:33 10.0.4.225 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.106 1 FULL/DR 00:00:33 10.0.1.150 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.51 1 FULL/DR 00:00:33 10.0.4.206 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.22 1 FULL/DR 00:00:33 10.0.5.63 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.17 1 FULL/DR 00:00:33 10.0.5.68 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.1.219) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.219\nAdvertising Router: 10.0.1.219\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.189 1 FULL/DR 00:00:33 10.0.5.245 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.182 1 FULL/DR 00:00:33 10.0.1.177 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.126 1 FULL/DR 00:00:33 10.0.5.215 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.33 1 FULL/DR 00:00:33 10.0.3.102 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.110 1 FULL/DR 00:00:33 10.0.4.32 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.211 1 FULL/DR 00:00:33 10.0.1.101 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.125 1 FULL/DR 00:00:33 10.0.4.252 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.105 1 FULL/DR 00:00:33 10.0.4.21 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.135 1 FULL/DR 00:00:33 10.0.5.67 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.13 1 FULL/DR 00:00:33 10.0.2.103 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.252 1 FULL/DR 00:00:33 10.0.5.43 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.239 1 FULL/DR 00:00:33 10.0.4.196 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.1.220) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.220\nAdvertising Router: 10.0.1.220\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.82 1 FULL/DR 00:00:33 10.0.1.212 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.206 1 FULL/DR 00:00:33 10.0.3.140 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.24 1 FULL/DR 00:00:33 10.0.1.252 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.92 1 FULL/DR 00:00:33 10.0.3.10 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.11 1 FULL/DR 00:00:33 10.0.1.5 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.72 1 FULL/DR 00:00:33 10.0.1.42 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.250 1 FULL/DR 00:00:33 10.0.5.35 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.232 1 FULL/DR 00:00:33 10.0.3.66 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.51 1 FULL/DR 00:00:33 10.0.1.218 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.11 1 FULL/DR 00:00:33 10.0.3.24 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.184 1 FULL/DR 00:00:33 10.0.4.232 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.150 1 FULL/DR 00:00:33 10.0.4.91 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.220 1 FULL/DR 00:00:33 10.0.3.61 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.36 1 FULL/DR 00:00:33 10.0.3.155 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.193 1 FULL/DR 00:00:33 10.0.2.124 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.223 1 FULL/DR 00:00:33 10.0.4.165 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.36 1 FULL/DR 00:00:33 10.0.2.128 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.32 1 FULL/DR 00:00:33 10.0.4.210 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.160 1 FULL/DR 00:00:33 10.0.5.134 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.2 1 FULL/DR 00:00:33 10.0.4.235 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.81 1 FULL/DR 00:00:33 10.0.3.179 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.146 1 FULL/DR 00:00:33 10.0.3.30 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.1.137) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.137\nAdvertising Router: 10.0.1.137\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.189 1 FULL/DR 00:00:33 10.0.1.242 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.0.46) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.46\nAdvertising Router: 10.0.0.46\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.213 1 FULL/DR 00:00:33 10.0.3.183 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.119 1 FULL/DR 00:00:33 10.0.2.155 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.11 1 FULL/DR 00:00:33 10.0.1.148 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.247 1 FULL/DR 00:00:33 10.0.2.167 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.20 1 FULL/DR 00:00:33 10.0.1.251 GigabitEthernet0/2\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.23 1 FULL/DR 00:00:33 10.0.1.199 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.183 1 FULL/DR 00:00:33 10.0.2.189 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.176 1 FULL/DR 00:00:33 10.0.5.232 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.71 1 FULL/DR 00:00:33 10.0.3.210 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.182 1 FULL/DR 00:00:33 10.0.2.193 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.108 1 FULL/DR 00:00:33 10.0.2.218 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.35 1 FULL/DR 00:00:33 10.0.5.158 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.131 1 FULL/DR 00:00:33 10.0.2.17 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.80 1 FULL/DR 00:00:33 10.0.4.14 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.199 1 FULL/DR 00:00:33 10.0.2.223 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.0.41) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.41\nAdvertising Router: 10.0.0.41\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.241 1 FULL/DR 00:00:33 10.0.2.162 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.60 1 FULL/DR 00:00:33 10.0.3.189 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.22 1 FULL/DR 00:00:33 10.0.3.16 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.157 1 FULL/DR 00:00:33 10.0.3.182 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.226 1 FULL/DR 00:00:33 10.0.4.131 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.115 1 FULL/DR 00:00:33 10.0.4.34 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.211 1 FULL/DR 00:00:33 10.0.4.112 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.225 1 FULL/DR 00:00:33 10.0.5.208 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.179 1 FULL/DR 00:00:33 10.0.4.220 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.240 1 FULL/DR 00:00:33 10.0.3.151 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.243 1 FULL/DR 00:00:33 10.0.2.22 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.240 1 FULL/DR 00:00:33 10.0.1.95 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.4.118) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.118\nAdvertising Router: 10.0.4.118\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.247 1 FULL/DR 00:00:33 10.0.1.36 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.114 1 FULL/DR 00:00:33 10.0.4.45 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.53 1 FULL/DR 00:00:33 10.0.3.53 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.95 1 FULL/DR 00:00:33 10.0.3.95 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.4.44) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.44\nAdvertising Router: 10.0.4.44\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.16 1 FULL/DR 00:00:33 10.0.3.164 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.144 1 FULL/DR 00:00:33 10.0.2.242 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.169 1 FULL/DR 00:00:33 10.0.2.115 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.53 1 FULL/DR 00:00:33 10.0.5.102 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.48 1 FULL/DR 00:00:33 10.0.4.125 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.195 1 FULL/DR 00:00:33 10.0.5.248 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.196 1 FULL/DR 00:00:33 10.0.3.183 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.100 1 FULL/DR 00:00:33 10.0.3.218 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.118 1 FULL/DR 00:00:33 10.0.3.178 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.127 1 FULL/DR 00:00:33 10.0.2.33 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.105 1 FULL/DR 00:00:33 10.0.2.63 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.40 1 FULL/DR 00:00:33 10.0.4.84 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.5 1 FULL/DR 00:00:33 10.0.5.76 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.192 1 FULL/DR 00:00:33 10.0.2.143 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.1.114) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.114\nAdvertising Router: 10.0.1.114\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.178 1 FULL/DR 00:00:33 10.0.3.109 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.124 1 FULL/DR 00:00:33 10.0.5.156 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.110 1 FULL/DR 00:00:33 10.0.3.239 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.3.182) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.182\nAdvertising Router: 10.0.3.182\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.213 1 FULL/DR 00:00:33 10.0.1.126 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.108 1 FULL/DR 00:00:33 10.0.3.175 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.55 1 FULL/DR 00:00:33 10.0.5.44 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.40 1 FULL/DR 00:00:33 10.0.1.143 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.3.33) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.33\nAdvertising Router: 10.0.3.33\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.49 1 FULL/DR 00:00:33 10.0.3.236 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.157 1 FULL/DR 00:00:33 10.0.1.69 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.123 1 FULL/DR 00:00:33 10.0.2.69 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.105 1 FULL/DR 00:00:33 10.0.1.228 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.23 1 FULL/DR 00:00:33 10.0.3.43 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.134 1 FULL/DR 00:00:33 10.0.3.67 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.159 1 FULL/DR 00:00:33 10.0.5.36 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.67 1 FULL/DR 00:00:33 10.0.1.10 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.181 1 FULL/DR 00:00:33 10.0.4.212 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.51 1 FULL/DR 00:00:33 10.0.4.56 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.85 1 FULL/DR 00:00:33 10.0.4.181 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.84 1 FULL/DR 00:00:33 10.0.1.53 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.230 1 FULL/DR 00:00:33 10.0.2.41 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.64 1 FULL/DR 00:00:33 10.0.2.229 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.4.62) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.62\nAdvertising Router: 10.0.4.62\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.226 1 FULL/DR 00:00:33 10.0.4.198 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.55 1 FULL/DR 00:00:33 10.0.2.18 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.213 1 FULL/DR 00:00:33 10.0.4.72 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.239 1 FULL/DR 00:00:33 10.0.4.48 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.237 1 FULL/DR 00:00:33 10.0.2.88 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.143 1 FULL/DR 00:00:33 10.0.3.20 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.4.61) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.61\nAdvertising Router: 10.0.4.61\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.117 1 FULL/DR 00:00:33 10.0.5.237 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.162 1 FULL/DR 00:00:33 10.0.5.168 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.3.168) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.168\nAdvertising Router: 10.0.3.168\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.30 1 FULL/DR 00:00:33 10.0.2.152 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.1 1 FULL/DR 00:00:33 10.0.4.159 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.8 1 FULL/DR 00:00:33 10.0.2.224 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.111 1 FULL/DR 00:00:33 10.0.5.189 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.166 1 FULL/DR 00:00:33 10.0.1.102 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.230 1 FULL/DR 00:00:33 10.0.1.210 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.167 1 FULL/DR 00:00:33 10.0.5.9 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.69 1 FULL/DR 00:00:33 10.0.3.73 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.1 1 FULL/DR 00:00:33 10.0.3.56 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.2.147) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.147\nAdvertising Router: 10.0.2.147\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.41 1 FULL/DR 00:00:33 10.0.2.108 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.234 1 FULL/DR 00:00:33 10.0.2.203 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.32 1 FULL/DR 00:00:33 10.0.4.124 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.132 1 FULL/DR 00:00:33 10.0.1.56 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.1.253) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.253\nAdvertising Router: 10.0.1.253\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.240 1 FULL/DR 00:00:33 10.0.3.62 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.189 1 FULL/DR 00:00:33 10.0.5.177 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.2.109) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.109\nAdvertising Router: 10.0.2.109\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.233 1 FULL/DR 00:00:33 10.0.2.154 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.48 1 FULL/DR 00:00:33 10.0.4.40 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.215 1 FULL/DR 00:00:33 10.0.2.62 GigabitEthernet0/2\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.111 1 FULL/DR 00:00:33 10.0.2.117 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.204 1 FULL/DR 00:00:33 10.0.1.209 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.235 1 FULL/DR 00:00:33 10.0.4.46 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.224 1 FULL/DR 00:00:33 10.0.2.152 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.147 1 FULL/DR 00:00:33 10.0.1.156 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.222 1 FULL/DR 00:00:33 10.0.2.4 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.206 1 FULL/DR 00:00:33 10.0.3.183 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.118 1 FULL/DR 00:00:33 10.0.1.136 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.38 1 FULL/DR 00:00:33 10.0.2.112 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.39 1 FULL/DR 00:00:33 10.0.2.71 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.4 1 FULL/DR 00:00:33 10.0.4.211 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.4 1 FULL/DR 00:00:33 10.0.1.185 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.229 1 FULL/DR 00:00:33 10.0.2.9 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.14 1 FULL/DR 00:00:33 10.0.1.179 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.204 1 FULL/DR 00:00:33 10.0.5.14 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.142 1 FULL/DR 00:00:33 10.0.1.114 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.160 1 FULL/DR 00:00:33 10.0.5.146 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.229 1 FULL/DR 00:00:33 10.0.4.69 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.89 1 FULL/DR 00:00:33 10.0.4.221 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.3.191) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.191\nAdvertising Router: 10.0.3.191\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.220 1 FULL/DR 00:00:33 10.0.5.72 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.10 1 FULL/DR 00:00:33 10.0.4.97 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.136 1 FULL/DR 00:00:33 10.0.3.77 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.22 1 FULL/DR 00:00:33 10.0.4.102 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.5.65) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.5.65\nAdvertising Router: 10.0.5.65\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.165 1 FULL/DR 00:00:33 10.0.2.179 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.225 1 FULL/DR 00:00:33 10.0.2.149 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.96 1 FULL/DR 00:00:33 10.0.4.151 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.106 1 FULL/DR 00:00:33 10.0.2.241 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.241 1 FULL/DR 00:00:33 10.0.1.214 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.224 1 FULL/DR 00:00:33 10.0.2.90 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.4.72) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.72\nAdvertising Router: 10.0.4.72\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.72 1 FULL/DR 00:00:33 10.0.2.243 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.40 1 FULL/DR 00:00:33 10.0.4.248 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.91 1 FULL/DR 00:00:33 10.0.4.188 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.2.97) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.97\nAdvertising Router: 10.0.2.97\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.191 1 FULL/DR 00:00:33 10.0.4.71 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.0.165) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.165\nAdvertising Router: 10.0.0.165\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.68 1 FULL/DR 00:00:33 10.0.3.247 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.98 1 FULL/DR 00:00:33 10.0.5.23 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.152 1 FULL/DR 00:00:33 10.0.1.123 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.221 1 FULL/DR 00:00:33 10.0.5.242 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.37 1 FULL/DR 00:00:33 10.0.2.70 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.72 1 FULL/DR 00:00:33 10.0.2.138 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.170 1 FULL/DR 00:00:33 10.0.3.209 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.225 1 FULL/DR 00:00:33 10.0.2.250 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.3.1) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.1\nAdvertising Router: 10.0.3.1\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.172 1 FULL/DR 00:00:33 10.0.1.3 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.113 1 FULL/DR 00:00:33 10.0.1.201 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.116 1 FULL/DR 00:00:33 10.0.1.253 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.40 1 FULL/DR 00:00:33 10.0.4.127 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.206 1 FULL/DR 00:00:33 10.0.4.5 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.135 1 FULL/DR 00:00:33 10.0.1.130 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.0.95) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.95\nAdvertising Router: 10.0.0.95\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.36 1 FULL/DR 00:00:33 10.0.1.191 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.221 1 FULL/DR 00:00:33 10.0.3.29 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.90 1 FULL/DR 00:00:33 10.0.5.53 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.2.147) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.147\nAdvertising Router: 10.0.2.147\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.8 1 FULL/DR 00:00:33 10.0.3.160 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.222 1 FULL/DR 00:00:33 10.0.1.244 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.97 1 FULL/DR 00:00:33 10.0.5.212 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.121 1 FULL/DR 00:00:33 10.0.2.51 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.27 1 FULL/DR 00:00:33 10.0.4.217 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.29 1 FULL/DR 00:00:33 10.0.5.203 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.148 1 FULL/DR 00:00:33 10.0.4.164 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.21 1 FULL/DR 00:00:33 10.0.5.97 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.233 1 FULL/DR 00:00:33 10.0.1.11 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.192 1 FULL/DR 00:00:33 10.0.1.3 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.163 1 FULL/DR 00:00:33 10.0.4.167 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.4.16) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.16\nAdvertising Router: 10.0.4.16\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.103 1 FULL/DR 00:00:33 10.0.4.206 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.5.11) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.5.11\nAdvertising Router: 10.0.5.11\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.75 1 FULL/DR 00:00:33 10.0.1.238 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.4.191) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.191\nAdvertising Router: 10.0.4.191\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.99 1 FULL/DR 00:00:33 10.0.4.169 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.2.191) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.191\nAdvertising Router: 10.0.2.191\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.99 1 FULL/DR 00:00:33 10.0.3.129 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.107 1 FULL/DR 00:00:33 10.0.4.39 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.103 1 FULL/DR 00:00:33 10.0.5.83 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.142 1 FULL/DR 00:00:33 10.0.4.132 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.38 1 FULL/DR 00:00:33 10.0.2.159 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.5.232) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.5.232\nAdvertising Router: 10.0.5.232\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.166 1 FULL/DR 00:00:33 10.0.5.65 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.0.99) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.99\nAdvertising Router: 10.0.0.99\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.80 1 FULL/DR 00:00:33 10.0.2.75 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.249 1 FULL/DR 00:00:33 10.0.4.34 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.249 1 FULL/DR 00:00:33 10.0.3.253 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.55 1 FULL/DR 00:00:33 10.0.4.125 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.3.145) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.145\nAdvertising Router: 10.0.3.145\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.39 1 FULL/DR 00:00:33 10.0.4.212 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.199 1 FULL/DR 00:00:33 10.0.5.238 GigabitEthernet0/2\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.130 1 FULL/DR 00:00:33 10.0.2.60 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.254 1 FULL/DR 00:00:33 10.0.3.149 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.202 1 FULL/DR 00:00:33 10.0.3.199 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.223 1 FULL/DR 00:00:33 10.0.1.56 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.15 1 FULL/DR 00:00:33 10.0.2.129 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.35 1 FULL/DR 00:00:33 10.0.4.51 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.249 1 FULL/DR 00:00:33 10.0.2.79 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.71 1 FULL/DR 00:00:33 10.0.4.191 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.36 1 FULL/DR 00:00:33 10.0.1.28 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.179 1 FULL/DR 00:00:33 10.0.1.240 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.221 1 FULL/DR 00:00:33 10.0.2.154 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.200 1 FULL/DR 00:00:33 10.0.5.155 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.2.7) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.7\nAdvertising Router: 10.0.2.7\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.2 1 FULL/DR 00:00:33 10.0.5.242 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.204 1 FULL/DR 00:00:33 10.0.2.188 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.188 1 FULL/DR 00:00:33 10.0.2.3 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.4.105) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.105\nAdvertising Router: 10.0.4.105\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.64 1 FULL/DR 00:00:33 10.0.1.103 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.205 1 FULL/DR 00:00:33 10.0.2.4 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.7 1 FULL/DR 00:00:33 10.0.5.137 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.139 1 FULL/DR 00:00:33 10.0.5.228 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.71 1 FULL/DR 00:00:33 10.0.1.125 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.179 1 FULL/DR 00:00:33 10.0.4.128 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.176 1 FULL/DR 00:00:33 10.0.5.99 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.0.16) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.16\nAdvertising Router: 10.0.0.16\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.131 1 FULL/DR 00:00:33 10.0.1.6 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.223 1 FULL/DR 00:00:33 10.0.3.48 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.22 1 FULL/DR 00:00:33 10.0.3.177 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.176 1 FULL/DR 00:00:33 10.0.1.181 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.45 1 FULL/DR 00:00:33 10.0.2.161 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.19 1 FULL/DR 00:00:33 10.0.5.153 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.187 1 FULL/DR 00:00:33 10.0.1.162 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.221 1 FULL/DR 00:00:33 10.0.3.221 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.118 1 FULL/DR 00:00:33 10.0.5.140 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.140 1 FULL/DR 00:00:33 10.0.4.112 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.4.58) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.58\nAdvertising Router: 10.0.4.58\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.4 1 FULL/DR 00:00:33 10.0.2.110 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.100 1 FULL/DR 00:00:33 10.0.5.77 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.208 1 FULL/DR 00:00:33 10.0.4.85 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.118 1 FULL/DR 00:00:33 10.0.4.233 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.62 1 FULL/DR 00:00:33 10.0.2.115 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.68 1 FULL/DR 00:00:33 10.0.5.127 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.3.15) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.15\nAdvertising Router: 10.0.3.15\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.85 1 FULL/DR 00:00:33 10.0.5.19 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.200 1 FULL/DR 00:00:33 10.0.4.47 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.244 1 FULL/DR 00:00:33 10.0.1.149 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.237 1 FULL/DR 00:00:33 10.0.2.66 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.46 1 FULL/DR 00:00:33 10.0.1.33 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.24 1 FULL/DR 00:00:33 10.0.1.173 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.151 1 FULL/DR 00:00:33 10.0.1.232 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.187 1 FULL/DR 00:00:33 10.0.2.19 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.195 1 FULL/DR 00:00:33 10.0.4.188 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.139 1 FULL/DR 00:00:33 10.0.5.46 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.131 1 FULL/DR 00:00:33 10.0.4.44 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.3 1 FULL/DR 00:00:33 10.0.5.151 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.91 1 FULL/DR 00:00:33 10.0.2.144 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.201 1 FULL/DR 00:00:33 10.0.3.106 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.75 1 FULL/DR 00:00:33 10.0.2.95 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.226 1 FULL/DR 00:00:33 10.0.3.215 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.157 1 FULL/DR 00:00:33 10.0.4.229 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.116 1 FULL/DR 00:00:33 10.0.3.219 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.173 1 FULL/DR 00:00:33 10.0.1.44 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.4.209) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.209\nAdvertising Router: 10.0.4.209\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.123 1 FULL/DR 00:00:33 10.0.4.242 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.190 1 FULL/DR 00:00:33 10.0.1.179 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.124 1 FULL/DR 00:00:33 10.0.3.33 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.153 1 FULL/DR 00:00:33 10.0.2.182 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.94 1 FULL/DR 00:00:33 10.0.1.215 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.86 1 FULL/DR 00:00:33 10.0.3.19 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.12 1 FULL/DR 00:00:33 10.0.5.166 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.80 1 FULL/DR 00:00:33 10.0.1.132 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.226 1 FULL/DR 00:00:33 10.0.3.216 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.82 1 FULL/DR 00:00:33 10.0.3.62 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.54 1 FULL/DR 00:00:33 10.0.5.59 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.212 1 FULL/DR 00:00:33 10.0.1.223 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.2.207) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.207\nAdvertising Router: 10.0.2.207\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.142 1 FULL/DR 00:00:33 10.0.1.110 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.68 1 FULL/DR 00:00:33 10.0.2.139 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.200 1 FULL/DR 00:00:33 10.0.4.207 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.99 1 FULL/DR 00:00:33 10.0.5.211 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.193 1 FULL/DR 00:00:33 10.0.4.136 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.201 1 FULL/DR 00:00:33 10.0.2.103 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.165 1 FULL/DR 00:00:33 10.0.4.160 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.57 1 FULL/DR 00:00:33 10.0.1.223 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.196 1 FULL/DR 00:00:33 10.0.2.168 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.19 1 FULL/DR 00:00:33 10.0.1.222 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.184 1 FULL/DR 00:00:33 10.0.1.17 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.2.101) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.101\nAdvertising Router: 10.0.2.101\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.83 1 FULL/DR 00:00:33 10.0.5.75 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.0.190) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.190\nAdvertising Router: 10.0.0.190\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.103 1 FULL/DR 00:00:33 10.0.3.217 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.174 1 FULL/DR 00:00:33 10.0.2.215 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.252 1 FULL/DR 00:00:33 10.0.4.155 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.207 1 FULL/DR 00:00:33 10.0.4.237 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.43 1 FULL/DR 00:00:33 10.0.5.21 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.82 1 FULL/DR 00:00:33 10.0.3.148 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.190 1 FULL/DR 00:00:33 10.0.1.55 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.126 1 FULL/DR 00:00:33 10.0.3.133 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.182 1 FULL/DR 00:00:33 10.0.2.236 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.86 1 FULL/DR 00:00:33 10.0.4.52 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.14 1 FULL/DR 00:00:33 10.0.5.65 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.125 1 FULL/DR 00:00:33 10.0.1.113 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.130 1 FULL/DR 00:00:33 10.0.1.209 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.103 1 FULL/DR 00:00:33 10.0.2.21 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.40 1 FULL/DR 00:00:33 10.0.4.165 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.119 1 FULL/DR 00:00:33 10.0.1.4 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.169 1 FULL/DR 00:00:33 10.0.5.234 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.163 1 FULL/DR 00:00:33 10.0.2.238 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.187 1 FULL/DR 00:00:33 10.0.4.124 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.83 1 FULL/DR 00:00:33 10.0.4.91 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.171 1 FULL/DR 00:00:33 10.0.2.204 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.5.238) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.5.238\nAdvertising Router: 10.0.5.238\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.226 1 FULL/DR 00:00:33 10.0.1.147 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.61 1 FULL/DR 00:00:33 10.0.3.137 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.2.87) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.87\nAdvertising Router: 10.0.2.87\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.55 1 FULL/DR 00:00:33 10.0.5.77 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.71 1 FULL/DR 00:00:33 10.0.2.229 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.132 1 FULL/DR 00:00:33 10.0.1.149 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.237 1 FULL/DR 00:00:33 10.0.4.192 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.54 1 FULL/DR 00:00:33 10.0.5.63 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.158 1 FULL/DR 00:00:33 10.0.3.87 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.139 1 FULL/DR 00:00:33 10.0.3.17 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.62 1 FULL/DR 00:00:33 10.0.1.72 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.173 1 FULL/DR 00:00:33 10.0.2.22 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.244 1 FULL/DR 00:00:33 10.0.5.147 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.5.216) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.5.216\nAdvertising Router: 10.0.5.216\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.147 1 FULL/DR 00:00:33 10.0.5.53 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.198 1 FULL/DR 00:00:33 10.0.2.124 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.5.206) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.5.206\nAdvertising Router: 10.0.5.206\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.35 1 FULL/DR 00:00:33 10.0.2.118 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.11 1 FULL/DR 00:00:33 10.0.2.219 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.20 1 FULL/DR 00:00:33 10.0.5.199 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.127 1 FULL/DR 00:00:33 10.0.1.96 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.42 1 FULL/DR 00:00:33 10.0.5.4 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.186 1 FULL/DR 00:00:33 10.0.1.12 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.61 1 FULL/DR 00:00:33 10.0.1.230 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.173 1 FULL/DR 00:00:33 10.0.3.86 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.61 1 FULL/DR 00:00:33 10.0.1.50 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.167 1 FULL/DR 00:00:33 10.0.1.185 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.110 1 FULL/DR 00:00:33 10.0.2.152 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.205 1 FULL/DR 00:00:33 10.0.1.57 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.193 1 FULL/DR 00:00:33 10.0.3.111 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.179 1 FULL/DR 00:00:33 10.0.2.186 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.3.231) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.231\nAdvertising Router: 10.0.3.231\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.221 1 FULL/DR 00:00:33 10.0.2.102 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.162 1 FULL/DR 00:00:33 10.0.4.39 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.110 1 FULL/DR 00:00:33 10.0.4.230 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.8 1 FULL/DR 00:00:33 10.0.5.137 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.56 1 FULL/DR 00:00:33 10.0.4.196 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.83 1 FULL/DR 00:00:33 10.0.3.90 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.98 1 FULL/DR 00:00:33 10.0.1.188 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.224 1 FULL/DR 00:00:33 10.0.5.115 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.63 1 FULL/DR 00:00:33 10.0.1.49 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.188 1 FULL/DR 00:00:33 10.0.2.231 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.239 1 FULL/DR 00:00:33 10.0.5.124 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.1 1 FULL/DR 00:00:33 10.0.2.50 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.228 1 FULL/DR 00:00:33 10.0.4.96 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.7 1 FULL/DR 00:00:33 10.0.4.97 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.111 1 FULL/DR 00:00:33 10.0.3.4 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.98 1 FULL/DR 00:00:33 10.0.5.243 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.62 1 FULL/DR 00:00:33 10.0.4.57 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.4.79) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.79\nAdvertising Router: 10.0.4.79\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.110 1 FULL/DR 00:00:33 10.0.1.14 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.217 1 FULL/DR 00:00:33 10.0.3.149 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.33 1 FULL/DR 00:00:33 10.0.5.127 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.177 1 FULL/DR 00:00:33 10.0.5.51 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.92 1 FULL/DR 00:00:33 10.0.4.169 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.224 1 FULL/DR 00:00:33 10.0.2.214 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.171 1 FULL/DR 00:00:33 10.0.3.68 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.227 1 FULL/DR 00:00:33 10.0.4.51 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.132 1 FULL/DR 00:00:33 10.0.2.107 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.204 1 FULL/DR 00:00:33 10.0.2.128 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.129 1 FULL/DR 00:00:33 10.0.1.45 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.147 1 FULL/DR 00:00:33 10.0.2.77 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.120 1 FULL/DR 00:00:33 10.0.3.95 GigabitEthernet0/2\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.185 1 FULL/DR 00:00:33 10.0.2.59 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.195 1 FULL/DR 00:00:33 10.0.4.136 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.242 1 FULL/DR 00:00:33 10.0.3.165 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.151 1 FULL/DR 00:00:33 10.0.3.204 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.214 1 FULL/DR 00:00:33 10.0.3.218 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.245 1 FULL/DR 00:00:33 10.0.4.167 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.98 1 FULL/DR 00:00:33 10.0.2.209 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.194 1 FULL/DR 00:00:33 10.0.5.28 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.137 1 FULL/DR 00:00:33 10.0.4.95 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.172 1 FULL/DR 00:00:33 10.0.4.212 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.129 1 FULL/DR 00:00:33 10.0.4.137 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.100 1 FULL/DR 00:00:33 10.0.1.91 GigabitEthernet0/2\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.1 1 FULL/DR 00:00:33 10.0.1.66 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.22 1 FULL/DR 00:00:33 10.0.3.40 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.1.63) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.63\nAdvertising Router: 10.0.1.63\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.187 1 FULL/DR 00:00:33 10.0.5.187 GigabitEthernet0/2\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.21 1 FULL/DR 00:00:33 10.0.5.51 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.224 1 FULL/DR 00:00:33 10.0.3.53 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.72 1 FULL/DR 00:00:33 10.0.5.19 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.146 1 FULL/DR 00:00:33 10.0.3.226 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.144 1 FULL/DR 00:00:33 10.0.1.122 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.217 1 FULL/DR 00:00:33 10.0.5.201 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.162 1 FULL/DR 00:00:33 10.0.4.138 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.141 1 FULL/DR 00:00:33 10.0.5.24 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.123 1 FULL/DR 00:00:33 10.0.4.96 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.48 1 FULL/DR 00:00:33 10.0.3.182 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.238 1 FULL/DR 00:00:33 10.0.1.23 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.168 1 FULL/DR 00:00:33 10.0.3.173 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.75 1 FULL/DR 00:00:33 10.0.4.67 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.4.122) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.122\nAdvertising Router: 10.0.4.122\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.248 1 FULL/DR 00:00:33 10.0.5.133 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.145 1 FULL/DR 00:00:33 10.0.1.241 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.37 1 FULL/DR 00:00:33 10.0.5.227 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.164 1 FULL/DR 00:00:33 10.0.2.89 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.2.221) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.221\nAdvertising Router: 10.0.2.221\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.147 1 FULL/DR 00:00:33 10.0.5.14 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.4.7) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.7\nAdvertising Router: 10.0.4.7\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.182 1 FULL/DR 00:00:33 10.0.5.180 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.32 1 FULL/DR 00:00:33 10.0.1.60 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.200 1 FULL/DR 00:00:33 10.0.1.224 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.100 1 FULL/DR 00:00:33 10.0.1.91 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.226 1 FULL/DR 00:00:33 10.0.1.130 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.137 1 FULL/DR 00:00:33 10.0.5.83 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.2.96) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.96\nAdvertising Router: 10.0.2.96\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.42 1 FULL/DR 00:00:33 10.0.5.166 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.174 1 FULL/DR 00:00:33 10.0.4.237 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.4.150) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.150\nAdvertising Router: 10.0.4.150\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.98 1 FULL/DR 00:00:33 10.0.5.104 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.188 1 FULL/DR 00:00:33 10.0.2.211 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.115 1 FULL/DR 00:00:33 10.0.4.64 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.8 1 FULL/DR 00:00:33 10.0.4.56 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.46 1 FULL/DR 00:00:33 10.0.3.201 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.128 1 FULL/DR 00:00:33 10.0.1.239 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.38 1 FULL/DR 00:00:33 10.0.3.5 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.16 1 FULL/DR 00:00:33 10.0.3.240 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.28 1 FULL/DR 00:00:33 10.0.1.115 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.239 1 FULL/DR 00:00:33 10.0.3.207 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.241 1 FULL/DR 00:00:33 10.0.1.116 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.245 1 FULL/DR 00:00:33 10.0.3.190 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.28 1 FULL/DR 00:00:33 10.0.5.212 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.4.214) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.214\nAdvertising Router: 10.0.4.214\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.221 1 FULL/DR 00:00:33 10.0.3.153 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.120 1 FULL/DR 00:00:33 10.0.3.163 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.150 1 FULL/DR 00:00:33 10.0.2.200 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.232 1 FULL/DR 00:00:33 10.0.1.250 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.116 1 FULL/DR 00:00:33 10.0.1.114 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.121 1 FULL/DR 00:00:33 10.0.3.7 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.125 1 FULL/DR 00:00:33 10.0.5.229 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.11 1 FULL/DR 00:00:33 10.0.3.91 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.5.123) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.5.123\nAdvertising Router: 10.0.5.123\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.93 1 FULL/DR 00:00:33 10.0.5.30 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.3.195) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.195\nAdvertising Router: 10.0.3.195\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.87 1 FULL/DR 00:00:33 10.0.3.223 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.66 1 FULL/DR 00:00:33 10.0.5.222 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.148 1 FULL/DR 00:00:33 10.0.3.87 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.57 1 FULL/DR 00:00:33 10.0.5.199 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.1.212) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.212\nAdvertising Router: 10.0.1.212\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.186 1 FULL/DR 00:00:33 10.0.5.53 GigabitEthernet0/2\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.87 1 FULL/DR 00:00:33 10.0.5.28 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.147 1 FULL/DR 00:00:33 10.0.1.143 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.72 1 FULL/DR 00:00:33 10.0.4.7 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.133 1 FULL/DR 00:00:33 10.0.2.160 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.243 1 FULL/DR 00:00:33 10.0.3.2 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.250 1 FULL/DR 00:00:33 10.0.5.76 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.5.126) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.5.126\nAdvertising Router: 10.0.5.126\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.131 1 FULL/DR 00:00:33 10.0.5.220 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.161 1 FULL/DR 00:00:33 10.0.2.47 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.128 1 FULL/DR 00:00:33 10.0.5.85 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.123 1 FULL/DR 00:00:33 10.0.5.177 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.64 1 FULL/DR 00:00:33 10.0.3.91 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.133 1 FULL/DR 00:00:33 10.0.5.126 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.2.51) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.51\nAdvertising Router: 10.0.2.51\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.23 1 FULL/DR 00:00:33 10.0.5.63 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.208 1 FULL/DR 00:00:33 10.0.1.195 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.214 1 FULL/DR 00:00:33 10.0.2.74 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.176 1 FULL/DR 00:00:33 10.0.5.143 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.235 1 FULL/DR 00:00:33 10.0.5.169 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.62 1 FULL/DR 00:00:33 10.0.2.218 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.162 1 FULL/DR 00:00:33 10.0.4.74 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.44 1 FULL/DR 00:00:33 10.0.1.202 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.192 1 FULL/DR 00:00:33 10.0.4.207 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.31 1 FULL/DR 00:00:33 10.0.4.193 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.94 1 FULL/DR 00:00:33 10.0.5.61 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.12 1 FULL/DR 00:00:33 10.0.1.101 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.150 1 FULL/DR 00:00:33 10.0.4.22 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.0.84) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.84\nAdvertising Router: 10.0.0.84\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.65 1 FULL/DR 00:00:33 10.0.2.21 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.111 1 FULL/DR 00:00:33 10.0.3.10 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.203 1 FULL/DR 00:00:33 10.0.5.253 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.99 1 FULL/DR 00:00:33 10.0.5.148 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.80 1 FULL/DR 00:00:33 10.0.3.61 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.193 1 FULL/DR 00:00:33 10.0.3.78 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.53 1 FULL/DR 00:00:33 10.0.5.194 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.2.110) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.110\nAdvertising Router: 10.0.2.110\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.38 1 FULL/DR 00:00:33 10.0.5.20 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.145 1 FULL/DR 00:00:33 10.0.3.64 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.10 1 FULL/DR 00:00:33 10.0.2.141 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.161 1 FULL/DR 00:00:33 10.0.1.103 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.44 1 FULL/DR 00:00:33 10.0.5.28 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.178 1 FULL/DR 00:00:33 10.0.4.205 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.98 1 FULL/DR 00:00:33 10.0.2.184 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.4.137) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.137\nAdvertising Router: 10.0.4.137\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.245 1 FULL/DR 00:00:33 10.0.3.5 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.1.99) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.99\nAdvertising Router: 10.0.1.99\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.24 1 FULL/DR 00:00:33 10.0.4.151 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.181 1 FULL/DR 00:00:33 10.0.5.158 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.1 1 FULL/DR 00:00:33 10.0.3.64 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.224 1 FULL/DR 00:00:33 10.0.5.163 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.238 1 FULL/DR 00:00:33 10.0.2.108 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.128 1 FULL/DR 00:00:33 10.0.4.154 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.111 1 FULL/DR 00:00:33 10.0.4.246 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.7 1 FULL/DR 00:00:33 10.0.2.12 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.225 1 FULL/DR 00:00:33 10.0.1.218 GigabitEthernet0/2\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.194 1 FULL/DR 00:00:33 10.0.2.33 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.2.19) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.19\nAdvertising Router: 10.0.2.19\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.46 1 FULL/DR 00:00:33 10.0.2.115 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.62 1 FULL/DR 00:00:33 10.0.2.83 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.143 1 FULL/DR 00:00:33 10.0.1.88 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.66 1 FULL/DR 00:00:33 10.0.2.14 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.88 1 FULL/DR 00:00:33 10.0.2.243 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.134 1 FULL/DR 00:00:33 10.0.4.15 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.3.181) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.181\nAdvertising Router: 10.0.3.181\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.208 1 FULL/DR 00:00:33 10.0.3.164 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.117 1 FULL/DR 00:00:33 10.0.1.20 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.231 1 FULL/DR 00:00:33 10.0.3.99 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.72 1 FULL/DR 00:00:33 10.0.3.80 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.77 1 FULL/DR 00:00:33 10.0.1.123 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.213 1 FULL/DR 00:00:33 10.0.4.203 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.85 1 FULL/DR 00:00:33 10.0.2.37 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.163 1 FULL/DR 00:00:33 10.0.2.94 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.191 1 FULL/DR 00:00:33 10.0.4.239 GigabitEthernet0/2\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.96 1 FULL/DR 00:00:33 10.0.3.18 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.88 1 FULL/DR 00:00:33 10.0.2.156 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.231 1 FULL/DR 00:00:33 10.0.2.119 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.146 1 FULL/DR 00:00:33 10.0.5.250 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.73 1 FULL/DR 00:00:33 10.0.4.126 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.70 1 FULL/DR 00:00:33 10.0.2.46 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.41 1 FULL/DR 00:00:33 10.0.2.20 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.1.69) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.69\nAdvertising Router: 10.0.1.69\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.159 1 FULL/DR 00:00:33 10.0.5.155 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.83 1 FULL/DR 00:00:33 10.0.1.110 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.118 1 FULL/DR 00:00:33 10.0.5.38 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.13 1 FULL/DR 00:00:33 10.0.5.115 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.194 1 FULL/DR 00:00:33 10.0.4.110 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.10 1 FULL/DR 00:00:33 10.0.5.139 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.61 1 FULL/DR 00:00:33 10.0.1.28 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.87 1 FULL/DR 00:00:33 10.0.1.47 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.162 1 FULL/DR 00:00:33 10.0.3.127 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.44 1 FULL/DR 00:00:33 10.0.2.152 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.211 1 FULL/DR 00:00:33 10.0.2.128 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.102 1 FULL/DR 00:00:33 10.0.2.121 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.231 1 FULL/DR 00:00:33 10.0.4.68 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.24 1 FULL/DR 00:00:33 10.0.4.68 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.28 1 FULL/DR 00:00:33 10.0.3.102 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.9 1 FULL/DR 00:00:33 10.0.1.129 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.234 1 FULL/DR 00:00:33 10.0.1.66 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.3.210) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.210\nAdvertising Router: 10.0.3.210\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.101 1 FULL/DR 00:00:33 10.0.4.28 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.205 1 FULL/DR 00:00:33 10.0.4.84 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.202 1 FULL/DR 00:00:33 10.0.4.3 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.38 1 FULL/DR 00:00:33 10.0.1.127 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.137 1 FULL/DR 00:00:33 10.0.5.208 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.135 1 FULL/DR 00:00:33 10.0.2.63 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.40 1 FULL/DR 00:00:33 10.0.3.156 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.82 1 FULL/DR 00:00:33 10.0.3.170 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.162 1 FULL/DR 00:00:33 10.0.1.79 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.113 1 FULL/DR 00:00:33 10.0.5.218 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.146 1 FULL/DR 00:00:33 10.0.3.48 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.19 1 FULL/DR 00:00:33 10.0.3.125 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.1.170) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.170\nAdvertising Router: 10.0.1.170\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.232 1 FULL/DR 00:00:33 10.0.1.63 GigabitEthernet0/2\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.135 1 FULL/DR 00:00:33 10.0.4.182 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.3.200) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.200\nAdvertising Router: 10.0.3.200\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.216 1 FULL/DR 00:00:33 10.0.5.171 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.217 1 FULL/DR 00:00:33 10.0.3.21 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.149 1 FULL/DR 00:00:33 10.0.4.41 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.0.151) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.151\nAdvertising Router: 10.0.0.151\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.79 1 FULL/DR 00:00:33 10.0.1.253 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.152 1 FULL/DR 00:00:33 10.0.2.180 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.85 1 FULL/DR 00:00:33 10.0.4.230 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.142 1 FULL/DR 00:00:33 10.0.5.130 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.67 1 FULL/DR 00:00:33 10.0.1.178 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.68 1 FULL/DR 00:00:33 10.0.2.181 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.150 1 FULL/DR 00:00:33 10.0.3.59 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.0.208) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.208\nAdvertising Router: 10.0.0.208\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.113 1 FULL/DR 00:00:33 10.0.1.138 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.4.189) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.189\nAdvertising Router: 10.0.4.189\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.206 1 FULL/DR 00:00:33 10.0.3.4 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.38 1 FULL/DR 00:00:33 10.0.5.121 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.162 1 FULL/DR 00:00:33 10.0.2.54 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.206 1 FULL/DR 00:00:33 10.0.2.56 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.42 1 FULL/DR 00:00:33 10.0.5.107 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.222 1 FULL/DR 00:00:33 10.0.5.87 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.16 1 FULL/DR 00:00:33 10.0.1.95 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.44 1 FULL/DR 00:00:33 10.0.3.209 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.42 1 FULL/DR 00:00:33 10.0.5.87 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.79 1 FULL/DR 00:00:33 10.0.4.234 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.4.45) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.45\nAdvertising Router: 10.0.4.45\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.1 1 FULL/DR 00:00:33 10.0.5.159 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.128 1 FULL/DR 00:00:33 10.0.5.7 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.2.204) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.204\nAdvertising Router: 10.0.2.204\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.212 1 FULL/DR 00:00:33 10.0.3.74 GigabitEthernet0/2\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.243 1 FULL/DR 00:00:33 10.0.4.44 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.206 1 FULL/DR 00:00:33 10.0.5.179 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.205 1 FULL/DR 00:00:33 10.0.1.93 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.155 1 FULL/DR 00:00:33 10.0.2.134 GigabitEthernet0/2\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.249 1 FULL/DR 00:00:33 10.0.5.83 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.155 1 FULL/DR 00:00:33 10.0.1.84 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.19 1 FULL/DR 00:00:33 10.0.4.108 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.66 1 FULL/DR 00:00:33 10.0.1.206 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.135 1 FULL/DR 00:00:33 10.0.5.38 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.182 1 FULL/DR 00:00:33 10.0.2.160 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.83 1 FULL/DR 00:00:33 10.0.4.176 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.27 1 FULL/DR 00:00:33 10.0.4.7 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.49 1 FULL/DR 00:00:33 10.0.5.190 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.112 1 FULL/DR 00:00:33 10.0.3.33 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.248 1 FULL/DR 00:00:33 10.0.4.100 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.132 1 FULL/DR 00:00:33 10.0.3.150 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.43 1 FULL/DR 00:00:33 10.0.3.3 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.139 1 FULL/DR 00:00:33 10.0.5.201 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.35 1 FULL/DR 00:00:33 10.0.2.214 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.221 1 FULL/DR 00:00:33 10.0.3.115 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.214 1 FULL/DR 00:00:33 10.0.2.133 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.85 1 FULL/DR 00:00:33 10.0.3.245 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.211 1 FULL/DR 00:00:33 10.0.1.113 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.111 1 FULL/DR 00:00:33 10.0.1.170 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.197 1 FULL/DR 00:00:33 10.0.2.9 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.237 1 FULL/DR 00:00:33 10.0.3.101 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.2 1 FULL/DR 00:00:33 10.0.3.167 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.72 1 FULL/DR 00:00:33 10.0.3.211 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.3.103) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.103\nAdvertising Router: 10.0.3.103\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.127 1 FULL/DR 00:00:33 10.0.2.248 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.136 1 FULL/DR 00:00:33 10.0.5.199 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.241 1 FULL/DR 00:00:33 10.0.3.71 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.54 1 FULL/DR 00:00:33 10.0.1.107 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.154 1 FULL/DR 00:00:33 10.0.4.10 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.172 1 FULL/DR 00:00:33 10.0.5.149 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.0.229) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.229\nAdvertising Router: 10.0.0.229\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.109 1 FULL/DR 00:00:33 10.0.2.218 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.253 1 FULL/DR 00:00:33 10.0.2.186 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.183 1 FULL/DR 00:00:33 10.0.5.102 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.22 1 FULL/DR 00:00:33 10.0.3.139 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.108 1 FULL/DR 00:00:33 10.0.5.83 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.17 1 FULL/DR 00:00:33 10.0.3.210 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.152 1 FULL/DR 00:00:33 10.0.5.222 GigabitEthernet0/2\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.53 1 FULL/DR 00:00:33 10.0.1.107 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.92 1 FULL/DR 00:00:33 10.0.5.5 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.150 1 FULL/DR 00:00:33 10.0.2.231 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.186 1 FULL/DR 00:00:33 10.0.3.54 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.167 1 FULL/DR 00:00:33 10.0.1.202 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.33 1 FULL/DR 00:00:33 10.0.5.13 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.108 1 FULL/DR 00:00:33 10.0.4.168 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.21 1 FULL/DR 00:00:33 10.0.4.123 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.116 1 FULL/DR 00:00:33 10.0.4.225 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.11 1 FULL/DR 00:00:33 10.0.5.19 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.248 1 FULL/DR 00:00:33 10.0.2.229 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.227 1 FULL/DR 00:00:33 10.0.1.165 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.51 1 FULL/DR 00:00:33 10.0.2.9 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.97 1 FULL/DR 00:00:33 10.0.2.55 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.53 1 FULL/DR 00:00:33 10.0.2.223 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.242 1 FULL/DR 00:00:33 10.0.5.9 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.23 1 FULL/DR 00:00:33 10.0.5.64 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.126 1 FULL/DR 00:00:33 10.0.3.150 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.237 1 FULL/DR 00:00:33 10.0.4.137 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.190 1 FULL/DR 00:00:33 10.0.2.107 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.128 1 FULL/DR 00:00:33 10.0.4.214 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.177 1 FULL/DR 00:00:33 10.0.2.149 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.226 1 FULL/DR 00:00:33 10.0.1.139 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.91 1 FULL/DR 00:00:33 10.0.2.11 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.174 1 FULL/DR 00:00:33 10.0.5.253 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.15 1 FULL/DR 00:00:33 10.0.4.140 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.123 1 FULL/DR 00:00:33 10.0.2.30 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.190 1 FULL/DR 00:00:33 10.0.3.136 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.82 1 FULL/DR 00:00:33 10.0.3.252 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.2.10) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.10\nAdvertising Router: 10.0.2.10\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.35 1 FULL/DR 00:00:33 10.0.1.212 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.229 1 FULL/DR 00:00:33 10.0.1.132 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.119 1 FULL/DR 00:00:33 10.0.3.121 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.102 1 FULL/DR 00:00:33 10.0.4.137 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.5.24) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.5.24\nAdvertising Router: 10.0.5.24\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.128 1 FULL/DR 00:00:33 10.0.4.59 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.170 1 FULL/DR 00:00:33 10.0.2.171 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.192 1 FULL/DR 00:00:33 10.0.5.48 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.81 1 FULL/DR 00:00:33 10.0.5.63 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.16 1 FULL/DR 00:00:33 10.0.4.161 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.223 1 FULL/DR 00:00:33 10.0.1.144 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.75 1 FULL/DR 00:00:33 10.0.5.28 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.234 1 FULL/DR 00:00:33 10.0.1.215 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.224 1 FULL/DR 00:00:33 10.0.3.233 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.116 1 FULL/DR 00:00:33 10.0.4.211 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.225 1 FULL/DR 00:00:33 10.0.5.244 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.8 1 FULL/DR 00:00:33 10.0.3.227 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.5.75) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.5.75\nAdvertising Router: 10.0.5.75\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.145 1 FULL/DR 00:00:33 10.0.4.84 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.3.122) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.122\nAdvertising Router: 10.0.3.122\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.223 1 FULL/DR 00:00:33 10.0.4.140 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.121 1 FULL/DR 00:00:33 10.0.3.20 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.223 1 FULL/DR 00:00:33 10.0.3.222 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.227 1 FULL/DR 00:00:33 10.0.5.117 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.251 1 FULL/DR 00:00:33 10.0.1.174 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.82 1 FULL/DR 00:00:33 10.0.3.12 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.134 1 FULL/DR 00:00:33 10.0.1.39 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.108 1 FULL/DR 00:00:33 10.0.5.17 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.0.45) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.45\nAdvertising Router: 10.0.0.45\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.191 1 FULL/DR 00:00:33 10.0.1.82 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.111 1 FULL/DR 00:00:33 10.0.5.88 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.0.54) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.54\nAdvertising Router: 10.0.0.54\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.38 1 FULL/DR 00:00:33 10.0.3.106 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.170 1 FULL/DR 00:00:33 10.0.5.55 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.47 1 FULL/DR 00:00:33 10.0.3.131 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.16 1 FULL/DR 00:00:33 10.0.5.217 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.212 1 FULL/DR 00:00:33 10.0.2.50 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.82 1 FULL/DR 00:00:33 10.0.1.241 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.159 1 FULL/DR 00:00:33 10.0.3.40 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.221 1 FULL/DR 00:00:33 10.0.2.189 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.229 1 FULL/DR 00:00:33 10.0.4.229 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.174 1 FULL/DR 00:00:33 10.0.4.201 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.96 1 FULL/DR 00:00:33 10.0.3.102 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.120 1 FULL/DR 00:00:33 10.0.5.189 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.1.198) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.198\nAdvertising Router: 10.0.1.198\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.241 1 FULL/DR 00:00:33 10.0.4.191 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.216 1 FULL/DR 00:00:33 10.0.3.232 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.2.103) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.103\nAdvertising Router: 10.0.2.103\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.72 1 FULL/DR 00:00:33 10.0.5.121 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.114 1 FULL/DR 00:00:33 10.0.3.129 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.121 1 FULL/DR 00:00:33 10.0.1.106 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.56 1 FULL/DR 00:00:33 10.0.5.169 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.63 1 FULL/DR 00:00:33 10.0.4.17 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.135 1 FULL/DR 00:00:33 10.0.2.125 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.179 1 FULL/DR 00:00:33 10.0.1.115 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.36 1 FULL/DR 00:00:33 10.0.3.182 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.237 1 FULL/DR 00:00:33 10.0.3.46 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.207 1 FULL/DR 00:00:33 10.0.1.28 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.25 1 FULL/DR 00:00:33 10.0.4.20 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.1.18) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.18\nAdvertising Router: 10.0.1.18\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.34 1 FULL/DR 00:00:33 10.0.4.226 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.110 1 FULL/DR 00:00:33 10.0.2.117 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.164 1 FULL/DR 00:00:33 10.0.1.164 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.241 1 FULL/DR 00:00:33 10.0.2.223 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.131 1 FULL/DR 00:00:33 10.0.3.69 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.226 1 FULL/DR 00:00:33 10.0.5.235 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.37 1 FULL/DR 00:00:33 10.0.5.215 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.183 1 FULL/DR 00:00:33 10.0.5.31 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.51 1 FULL/DR 00:00:33 10.0.3.33 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.2.197) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.197\nAdvertising Router: 10.0.2.197\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.70 1 FULL/DR 00:00:33 10.0.3.7 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.6 1 FULL/DR 00:00:33 10.0.2.92 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.2.91) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.91\nAdvertising Router: 10.0.2.91\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.173 1 FULL/DR 00:00:33 10.0.3.181 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.139 1 FULL/DR 00:00:33 10.0.3.51 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.21 1 FULL/DR 00:00:33 10.0.2.13 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.184 1 FULL/DR 00:00:33 10.0.4.45 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.121 1 FULL/DR 00:00:33 10.0.2.172 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.70 1 FULL/DR 00:00:33 10.0.2.4 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.58 1 FULL/DR 00:00:33 10.0.5.242 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.113 1 FULL/DR 00:00:33 10.0.1.142 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.1 1 FULL/DR 00:00:33 10.0.5.107 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.34 1 FULL/DR 00:00:33 10.0.1.38 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.208 1 FULL/DR 00:00:33 10.0.5.113 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.16 1 FULL/DR 00:00:33 10.0.3.141 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.109 1 FULL/DR 00:00:33 10.0.5.33 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.33 1 FULL/DR 00:00:33 10.0.4.253 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.182 1 FULL/DR 00:00:33 10.0.1.139 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.235 1 FULL/DR 00:00:33 10.0.1.21 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.246 1 FULL/DR 00:00:33 10.0.4.247 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.33 1 FULL/DR 00:00:33 10.0.1.85 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.67 1 FULL/DR 00:00:33 10.0.5.223 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.1.219) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.219\nAdvertising Router: 10.0.1.219\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.135 1 FULL/DR 00:00:33 10.0.3.88 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.128 1 FULL/DR 00:00:33 10.0.3.154 GigabitEthernet0/2\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.149 1 FULL/DR 00:00:33 10.0.3.62 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.223 1 FULL/DR 00:00:33 10.0.2.131 GigabitEthernet0/2\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.128 1 FULL/DR 00:00:33 10.0.5.81 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.0.97) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.97\nAdvertising Router: 10.0.0.97\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.244 1 FULL/DR 00:00:33 10.0.5.84 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.184 1 FULL/DR 00:00:33 10.0.3.56 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.119 1 FULL/DR 00:00:33 10.0.3.116 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.89 1 FULL/DR 00:00:33 10.0.5.172 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.248 1 FULL/DR 00:00:33 10.0.5.16 GigabitEthernet0/2\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.140 1 FULL/DR 00:00:33 10.0.1.231 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.197 1 FULL/DR 00:00:33 10.0.2.83 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.218 1 FULL/DR 00:00:33 10.0.4.194 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.85 1 FULL/DR 00:00:33 10.0.2.235 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.248 1 FULL/DR 00:00:33 10.0.1.145 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.226 1 FULL/DR 00:00:33 10.0.5.144 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.160 1 FULL/DR 00:00:33 10.0.4.166 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.206 1 FULL/DR 00:00:33 10.0.5.164 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.103 1 FULL/DR 00:00:33 10.0.1.54 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.249 1 FULL/DR 00:00:33 10.0.5.232 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.174 1 FULL/DR 00:00:33 10.0.5.3 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.248 1 FULL/DR 00:00:33 10.0.1.235 GigabitEthernet0/2\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.146 1 FULL/DR 00:00:33 10.0.2.164 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.201 1 FULL/DR 00:00:33 10.0.3.235 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.170 1 FULL/DR 00:00:33 10.0.2.33 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.215 1 FULL/DR 00:00:33 10.0.4.190 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.181 1 FULL/DR 00:00:33 10.0.2.212 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.224 1 FULL/DR 00:00:33 10.0.4.6 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.164 1 FULL/DR 00:00:33 10.0.2.144 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.41 1 FULL/DR 00:00:33 10.0.2.14 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.220 1 FULL/DR 00:00:33 10.0.4.15 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.24 1 FULL/DR 00:00:33 10.0.4.102 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.245 1 FULL/DR 00:00:33 10.0.2.108 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.222 1 FULL/DR 00:00:33 10.0.5.182 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.172 1 FULL/DR 00:00:33 10.0.3.139 GigabitEthernet0/2\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.153 1 FULL/DR 00:00:33 10.0.4.67 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.60 1 FULL/DR 00:00:33 10.0.3.148 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.192 1 FULL/DR 00:00:33 10.0.5.13 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.1.63) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.63\nAdvertising Router: 10.0.1.63\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.2 1 FULL/DR 00:00:33 10.0.1.218 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.208 1 FULL/DR 00:00:33 10.0.4.163 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.2.211) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.211\nAdvertising Router: 10.0.2.211\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.153 1 FULL/DR 00:00:33 10.0.1.147 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.151 1 FULL/DR 00:00:33 10.0.1.29 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.223 1 FULL/DR 00:00:33 10.0.2.44 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.151 1 FULL/DR 00:00:33 10.0.3.154 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.243 1 FULL/DR 00:00:33 10.0.1.41 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.171 1 FULL/DR 00:00:33 10.0.2.178 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.46 1 FULL/DR 00:00:33 10.0.3.143 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.20 1 FULL/DR 00:00:33 10.0.2.161 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.109 1 FULL/DR 00:00:33 10.0.2.203 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.138 1 FULL/DR 00:00:33 10.0.2.152 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.0.195) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.195\nAdvertising Router: 10.0.0.195\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.8 1 FULL/DR 00:00:33 10.0.1.233 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.244 1 FULL/DR 00:00:33 10.0.1.250 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.3.76) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.76\nAdvertising Router: 10.0.3.76\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.113 1 FULL/DR 00:00:33 10.0.1.191 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.106 1 FULL/DR 00:00:33 10.0.1.135 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.251 1 FULL/DR 00:00:33 10.0.5.25 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.17 1 FULL/DR 00:00:33 10.0.2.106 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.10 1 FULL/DR 00:00:33 10.0.3.14 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.207 1 FULL/DR 00:00:33 10.0.3.118 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.91 1 FULL/DR 00:00:33 10.0.1.70 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.102 1 FULL/DR 00:00:33 10.0.3.127 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.30 1 FULL/DR 00:00:33 10.0.4.2 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.20 1 FULL/DR 00:00:33 10.0.2.200 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.83 1 FULL/DR 00:00:33 10.0.3.48 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.4.55) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.55\nAdvertising Router: 10.0.4.55\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.57 1 FULL/DR 00:00:33 10.0.3.240 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.68 1 FULL/DR 00:00:33 10.0.1.250 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.120 1 FULL/DR 00:00:33 10.0.5.161 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.219 1 FULL/DR 00:00:33 10.0.4.69 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.254 1 FULL/DR 00:00:33 10.0.2.248 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.133 1 FULL/DR 00:00:33 10.0.1.44 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.112 1 FULL/DR 00:00:33 10.0.1.103 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.55 1 FULL/DR 00:00:33 10.0.5.93 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.250 1 FULL/DR 00:00:33 10.0.3.125 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.204 1 FULL/DR 00:00:33 10.0.5.105 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.115 1 FULL/DR 00:00:33 10.0.5.230 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.182 1 FULL/DR 00:00:33 10.0.4.219 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.0.2) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.2\nAdvertising Router: 10.0.0.2\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.242 1 FULL/DR 00:00:33 10.0.2.145 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.249 1 FULL/DR 00:00:33 10.0.3.10 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.95 1 FULL/DR 00:00:33 10.0.5.193 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.25 1 FULL/DR 00:00:33 10.0.1.199 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.37 1 FULL/DR 00:00:33 10.0.1.126 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.165 1 FULL/DR 00:00:33 10.0.5.72 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.202 1 FULL/DR 00:00:33 10.0.3.238 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.39 1 FULL/DR 00:00:33 10.0.5.139 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.5.221) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.5.221\nAdvertising Router: 10.0.5.221\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.157 1 FULL/DR 00:00:33 10.0.3.210 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.220 1 FULL/DR 00:00:33 10.0.1.109 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.210 1 FULL/DR 00:00:33 10.0.3.230 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.52 1 FULL/DR 00:00:33 10.0.3.164 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.1.132) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.132\nAdvertising Router: 10.0.1.132\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.72 1 FULL/DR 00:00:33 10.0.2.31 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.162 1 FULL/DR 00:00:33 10.0.5.204 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.90 1 FULL/DR 00:00:33 10.0.2.137 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.245 1 FULL/DR 00:00:33 10.0.2.75 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.236 1 FULL/DR 00:00:33 10.0.3.168 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.58 1 FULL/DR 00:00:33 10.0.5.181 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.241 1 FULL/DR 00:00:33 10.0.5.254 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.2.6) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.6\nAdvertising Router: 10.0.2.6\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.223 1 FULL/DR 00:00:33 10.0.4.26 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.26 1 FULL/DR 00:00:33 10.0.2.44 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.76 1 FULL/DR 00:00:33 10.0.4.72 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.237 1 FULL/DR 00:00:33 10.0.3.82 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.66 1 FULL/DR 00:00:33 10.0.5.84 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.230 1 FULL/DR 00:00:33 10.0.5.90 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.181 1 FULL/DR 00:00:33 10.0.1.157 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.247 1 FULL/DR 00:00:33 10.0.4.170 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.77 1 FULL/DR 00:00:33 10.0.1.46 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.88 1 FULL/DR 00:00:33 10.0.5.203 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.215 1 FULL/DR 00:00:33 10.0.5.12 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.99 1 FULL/DR 00:00:33 10.0.4.197 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.68 1 FULL/DR 00:00:33 10.0.5.196 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.45 1 FULL/DR 00:00:33 10.0.5.66 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.25 1 FULL/DR 00:00:33 10.0.5.158 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.192 1 FULL/DR 00:00:33 10.0.3.37 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.110 1 FULL/DR 00:00:33 10.0.3.237 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.209 1 FULL/DR 00:00:33 10.0.3.45 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.2.232) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.232\nAdvertising Router: 10.0.2.232\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.85 1 FULL/DR 00:00:33 10.0.4.201 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.196 1 FULL/DR 00:00:33 10.0.5.18 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.154 1 FULL/DR 00:00:33 10.0.4.14 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.4.237) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.237\nAdvertising Router: 10.0.4.237\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.203 1 FULL/DR 00:00:33 10.0.5.24 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.102 1 FULL/DR 00:00:33 10.0.3.67 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.252 1 FULL/DR 00:00:33 10.0.4.125 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.253 1 FULL/DR 00:00:33 10.0.4.34 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.193 1 FULL/DR 00:00:33 10.0.1.14 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.52 1 FULL/DR 00:00:33 10.0.1.46 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.147 1 FULL/DR 00:00:33 10.0.1.47 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.58 1 FULL/DR 00:00:33 10.0.3.170 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.1.192) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.192\nAdvertising Router: 10.0.1.192\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.221 1 FULL/DR 00:00:33 10.0.3.125 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.37 1 FULL/DR 00:00:33 10.0.3.185 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.48 1 FULL/DR 00:00:33 10.0.1.160 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.0.189) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.189\nAdvertising Router: 10.0.0.189\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.252 1 FULL/DR 00:00:33 10.0.5.119 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.2.109) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.109\nAdvertising Router: 10.0.2.109\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.178 1 FULL/DR 00:00:33 10.0.2.46 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.155 1 FULL/DR 00:00:33 10.0.5.31 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.186 1 FULL/DR 00:00:33 10.0.1.251 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.130 1 FULL/DR 00:00:33 10.0.2.226 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.140 1 FULL/DR 00:00:33 10.0.1.86 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.192 1 FULL/DR 00:00:33 10.0.2.127 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.140 1 FULL/DR 00:00:33 10.0.1.6 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.1.134) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.134\nAdvertising Router: 10.0.1.134\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.1 1 FULL/DR 00:00:33 10.0.4.221 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.27 1 FULL/DR 00:00:33 10.0.1.54 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.191 1 FULL/DR 00:00:33 10.0.3.48 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.23 1 FULL/DR 00:00:33 10.0.4.251 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.115 1 FULL/DR 00:00:33 10.0.5.169 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.217 1 FULL/DR 00:00:33 10.0.4.84 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.222 1 FULL/DR 00:00:33 10.0.5.253 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.1.178) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.178\nAdvertising Router: 10.0.1.178\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.48 1 FULL/DR 00:00:33 10.0.2.131 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.2.205) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.205\nAdvertising Router: 10.0.2.205\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.43 1 FULL/DR 00:00:33 10.0.5.231 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.86 1 FULL/DR 00:00:33 10.0.1.179 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.79 1 FULL/DR 00:00:33 10.0.2.43 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.199 1 FULL/DR 00:00:33 10.0.1.24 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.119 1 FULL/DR 00:00:33 10.0.1.242 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.197 1 FULL/DR 00:00:33 10.0.5.21 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.9 1 FULL/DR 00:00:33 10.0.5.72 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.222 1 FULL/DR 00:00:33 10.0.2.109 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.2.210) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.210\nAdvertising Router: 10.0.2.210\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.203 1 FULL/DR 00:00:33 10.0.2.177 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.203 1 FULL/DR 00:00:33 10.0.5.218 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.146 1 FULL/DR 00:00:33 10.0.4.193 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.126 1 FULL/DR 00:00:33 10.0.5.33 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.218 1 FULL/DR 00:00:33 10.0.3.54 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.26 1 FULL/DR 00:00:33 10.0.5.163 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.40 1 FULL/DR 00:00:33 10.0.3.89 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.217 1 FULL/DR 00:00:33 10.0.1.128 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.216 1 FULL/DR 00:00:33 10.0.1.10 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.150 1 FULL/DR 00:00:33 10.0.5.203 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.29 1 FULL/DR 00:00:33 10.0.3.216 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.68 1 FULL/DR 00:00:33 10.0.3.55 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.122 1 FULL/DR 00:00:33 10.0.1.43 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.239 1 FULL/DR 00:00:33 10.0.4.122 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.115 1 FULL/DR 00:00:33 10.0.4.105 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.131 1 FULL/DR 00:00:33 10.0.4.44 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.106 1 FULL/DR 00:00:33 10.0.2.110 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.217 1 FULL/DR 00:00:33 10.0.3.149 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.96 1 FULL/DR 00:00:33 10.0.5.62 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.150 1 FULL/DR 00:00:33 10.0.4.133 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.19 1 FULL/DR 00:00:33 10.0.2.100 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.30 1 FULL/DR 00:00:33 10.0.3.37 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.143 1 FULL/DR 00:00:33 10.0.5.101 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.43 1 FULL/DR 00:00:33 10.0.5.130 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.199 1 FULL/DR 00:00:33 10.0.1.229 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.159 1 FULL/DR 00:00:33 10.0.3.8 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.59 1 FULL/DR 00:00:33 10.0.2.58 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.3.155) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.155\nAdvertising Router: 10.0.3.155\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.141 1 FULL/DR 00:00:33 10.0.1.112 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.2.84) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.84\nAdvertising Router: 10.0.2.84\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.226 1 FULL/DR 00:00:33 10.0.2.226 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.163 1 FULL/DR 00:00:33 10.0.1.72 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.58 1 FULL/DR 00:00:33 10.0.3.33 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.254 1 FULL/DR 00:00:33 10.0.1.7 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.91 1 FULL/DR 00:00:33 10.0.4.66 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.190 1 FULL/DR 00:00:33 10.0.4.158 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.126 1 FULL/DR 00:00:33 10.0.1.205 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.37 1 FULL/DR 00:00:33 10.0.2.187 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.51 1 FULL/DR 00:00:33 10.0.4.47 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.115 1 FULL/DR 00:00:33 10.0.2.180 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.85 1 FULL/DR 00:00:33 10.0.4.201 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.5.244) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.5.244\nAdvertising Router: 10.0.5.244\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.149 1 FULL/DR 00:00:33 10.0.5.202 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.131 1 FULL/DR 00:00:33 10.0.4.136 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.1.224) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.224\nAdvertising Router: 10.0.1.224\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.146 1 FULL/DR 00:00:33 10.0.1.205 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.2 1 FULL/DR 00:00:33 10.0.2.63 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.112 1 FULL/DR 00:00:33 10.0.2.203 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.54 1 FULL/DR 00:00:33 10.0.3.35 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.253 1 FULL/DR 00:00:33 10.0.4.97 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.158 1 FULL/DR 00:00:33 10.0.2.94 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.92 1 FULL/DR 00:00:33 10.0.1.216 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.121 1 FULL/DR 00:00:33 10.0.1.245 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.158 1 FULL/DR 00:00:33 10.0.1.181 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.16 1 FULL/DR 00:00:33 10.0.5.53 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.37 1 FULL/DR 00:00:33 10.0.4.93 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.6 1 FULL/DR 00:00:33 10.0.1.242 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.66 1 FULL/DR 00:00:33 10.0.5.37 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.126 1 FULL/DR 00:00:33 10.0.5.42 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.166 1 FULL/DR 00:00:33 10.0.1.41 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.11 1 FULL/DR 00:00:33 10.0.1.49 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.212 1 FULL/DR 00:00:33 10.0.3.187 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.56 1 FULL/DR 00:00:33 10.0.3.170 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.133 1 FULL/DR 00:00:33 10.0.4.245 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.243 1 FULL/DR 00:00:33 10.0.1.108 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.3.11) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.11\nAdvertising Router: 10.0.3.11\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.229 1 FULL/DR 00:00:33 10.0.4.60 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.134 1 FULL/DR 00:00:33 10.0.1.83 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.147 1 FULL/DR 00:00:33 10.0.3.112 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.34 1 FULL/DR 00:00:33 10.0.2.74 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.30 1 FULL/DR 00:00:33 10.0.5.31 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.197 1 FULL/DR 00:00:33 10.0.2.235 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.143 1 FULL/DR 00:00:33 10.0.4.212 GigabitEthernet0/2\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.201 1 FULL/DR 00:00:33 10.0.2.111 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.165 1 FULL/DR 00:00:33 10.0.4.202 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.70 1 FULL/DR 00:00:33 10.0.4.42 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.174 1 FULL/DR 00:00:33 10.0.3.209 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.54 1 FULL/DR 00:00:33 10.0.4.156 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.22 1 FULL/DR 00:00:33 10.0.2.172 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.50 1 FULL/DR 00:00:33 10.0.4.234 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.187 1 FULL/DR 00:00:33 10.0.1.11 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.111 1 FULL/DR 00:00:33 10.0.3.109 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.245 1 FULL/DR 00:00:33 10.0.4.12 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.0.164) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.164\nAdvertising Router: 10.0.0.164\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.140 1 FULL/DR 00:00:33 10.0.3.242 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.56 1 FULL/DR 00:00:33 10.0.3.197 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.185 1 FULL/DR 00:00:33 10.0.3.197 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.80 1 FULL/DR 00:00:33 10.0.1.65 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.58 1 FULL/DR 00:00:33 10.0.4.13 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.185 1 FULL/DR 00:00:33 10.0.1.134 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.118 1 FULL/DR 00:00:33 10.0.2.168 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.2.46) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.46\nAdvertising Router: 10.0.2.46\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.194 1 FULL/DR 00:00:33 10.0.3.170 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.214 1 FULL/DR 00:00:33 10.0.2.58 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.149 1 FULL/DR 00:00:33 10.0.4.75 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.204 1 FULL/DR 00:00:33 10.0.3.217 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.2.32) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.32\nAdvertising Router: 10.0.2.32\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.154 1 FULL/DR 00:00:33 10.0.4.77 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.77 1 FULL/DR 00:00:33 10.0.2.40 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.160 1 FULL/DR 00:00:33 10.0.2.70 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.107 1 FULL/DR 00:00:33 10.0.2.10 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.38 1 FULL/DR 00:00:33 10.0.2.108 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.134 1 FULL/DR 00:00:33 10.0.1.104 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.46 1 FULL/DR 00:00:33 10.0.1.55 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.80 1 FULL/DR 00:00:33 10.0.5.170 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.196 1 FULL/DR 00:00:33 10.0.3.213 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.128 1 FULL/DR 00:00:33 10.0.5.174 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.192 1 FULL/DR 00:00:33 10.0.4.167 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.254 1 FULL/DR 00:00:33 10.0.1.74 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.22 1 FULL/DR 00:00:33 10.0.1.151 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.89 1 FULL/DR 00:00:33 10.0.4.208 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.234 1 FULL/DR 00:00:33 10.0.2.80 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.28 1 FULL/DR 00:00:33 10.0.2.158 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.166 1 FULL/DR 00:00:33 10.0.4.118 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.86 1 FULL/DR 00:00:33 10.0.4.6 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.3 1 FULL/DR 00:00:33 10.0.5.98 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.8 1 FULL/DR 00:00:33 10.0.1.157 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.226 1 FULL/DR 00:00:33 10.0.2.154 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.184 1 FULL/DR 00:00:33 10.0.2.56 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.5.137) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.5.137\nAdvertising Router: 10.0.5.137\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.71 1 FULL/DR 00:00:33 10.0.2.208 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.60 1 FULL/DR 00:00:33 10.0.5.157 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.128 1 FULL/DR 00:00:33 10.0.5.90 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.47 1 FULL/DR 00:00:33 10.0.4.76 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.201 1 FULL/DR 00:00:33 10.0.1.8 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.59 1 FULL/DR 00:00:33 10.0.1.109 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.0.211) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.211\nAdvertising Router: 10.0.0.211\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.248 1 FULL/DR 00:00:33 10.0.4.153 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.219 1 FULL/DR 00:00:33 10.0.1.28 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.239 1 FULL/DR 00:00:33 10.0.5.156 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.197 1 FULL/DR 00:00:33 10.0.4.129 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.143 1 FULL/DR 00:00:33 10.0.2.2 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.160 1 FULL/DR 00:00:33 10.0.2.216 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.204 1 FULL/DR 00:00:33 10.0.3.226 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.237 1 FULL/DR 00:00:33 10.0.4.187 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.86 1 FULL/DR 00:00:33 10.0.3.96 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.109 1 FULL/DR 00:00:33 10.0.1.137 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.198 1 FULL/DR 00:00:33 10.0.1.217 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.195 1 FULL/DR 00:00:33 10.0.3.247 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.17 1 FULL/DR 00:00:33 10.0.1.208 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.23 1 FULL/DR 00:00:33 10.0.4.233 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.3.40) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.40\nAdvertising Router: 10.0.3.40\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.1 1 FULL/DR 00:00:33 10.0.3.153 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.48 1 FULL/DR 00:00:33 10.0.5.166 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.55 1 FULL/DR 00:00:33 10.0.2.118 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.7 1 FULL/DR 00:00:33 10.0.5.246 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.126 1 FULL/DR 00:00:33 10.0.1.219 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.240 1 FULL/DR 00:00:33 10.0.3.120 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.137 1 FULL/DR 00:00:33 10.0.4.127 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.222 1 FULL/DR 00:00:33 10.0.2.213 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.80 1 FULL/DR 00:00:33 10.0.5.244 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.67 1 FULL/DR 00:00:33 10.0.5.166 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.1.157) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.157\nAdvertising Router: 10.0.1.157\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.177 1 FULL/DR 00:00:33 10.0.2.58 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.100 1 FULL/DR 00:00:33 10.0.1.251 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.11 1 FULL/DR 00:00:33 10.0.5.225 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.18 1 FULL/DR 00:00:33 10.0.3.151 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.101 1 FULL/DR 00:00:33 10.0.4.105 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.146 1 FULL/DR 00:00:33 10.0.5.196 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.27 1 FULL/DR 00:00:33 10.0.1.177 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.133 1 FULL/DR 00:00:33 10.0.2.16 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.10 1 FULL/DR 00:00:33 10.0.4.124 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.20 1 FULL/DR 00:00:33 10.0.1.117 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.114 1 FULL/DR 00:00:33 10.0.4.180 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.122 1 FULL/DR 00:00:33 10.0.2.187 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.38 1 FULL/DR 00:00:33 10.0.4.5 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.61 1 FULL/DR 00:00:33 10.0.5.119 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.40 1 FULL/DR 00:00:33 10.0.1.48 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.1.114) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.114\nAdvertising Router: 10.0.1.114\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.160 1 FULL/DR 00:00:33 10.0.4.45 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.82 1 FULL/DR 00:00:33 10.0.5.168 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.32 1 FULL/DR 00:00:33 10.0.2.131 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.181 1 FULL/DR 00:00:33 10.0.4.43 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.159 1 FULL/DR 00:00:33 10.0.5.53 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.248 1 FULL/DR 00:00:33 10.0.3.132 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.200 1 FULL/DR 00:00:33 10.0.3.218 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.2.93) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.93\nAdvertising Router: 10.0.2.93\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.90 1 FULL/DR 00:00:33 10.0.1.192 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.158 1 FULL/DR 00:00:33 10.0.1.174 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.128 1 FULL/DR 00:00:33 10.0.3.14 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.73 1 FULL/DR 00:00:33 10.0.1.208 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.230 1 FULL/DR 00:00:33 10.0.2.131 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.237 1 FULL/DR 00:00:33 10.0.3.101 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.37 1 FULL/DR 00:00:33 10.0.3.135 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.31 1 FULL/DR 00:00:33 10.0.3.71 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.54 1 FULL/DR 00:00:33 10.0.3.106 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.135 1 FULL/DR 00:00:33 10.0.5.140 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.221 1 FULL/DR 00:00:33 10.0.2.94 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.107 1 FULL/DR 00:00:33 10.0.5.82 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.211 1 FULL/DR 00:00:33 10.0.1.71 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.75 1 FULL/DR 00:00:33 10.0.5.73 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.10 1 FULL/DR 00:00:33 10.0.2.202 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.2.99) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.99\nAdvertising Router: 10.0.2.99\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.88 1 FULL/DR 00:00:33 10.0.5.212 GigabitEthernet0/2\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.131 1 FULL/DR 00:00:33 10.0.3.251 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.178 1 FULL/DR 00:00:33 10.0.3.174 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.50 1 FULL/DR 00:00:33 10.0.5.254 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.220 1 FULL/DR 00:00:33 10.0.3.153 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.9 1 FULL/DR 00:00:33 10.0.4.189 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.225 1 FULL/DR 00:00:33 10.0.4.125 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.107 1 FULL/DR 00:00:33 10.0.5.97 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.191 1 FULL/DR 00:00:33 10.0.4.220 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.9 1 FULL/DR 00:00:33 10.0.4.154 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.246 1 FULL/DR 00:00:33 10.0.4.27 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.233 1 FULL/DR 00:00:33 10.0.2.214 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.152 1 FULL/DR 00:00:33 10.0.2.164 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.166 1 FULL/DR 00:00:33 10.0.5.145 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.109 1 FULL/DR 00:00:33 10.0.5.168 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.157 1 FULL/DR 00:00:33 10.0.1.18 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.148 1 FULL/DR 00:00:33 10.0.4.59 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.78 1 FULL/DR 00:00:33 10.0.3.122 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.153 1 FULL/DR 00:00:33 10.0.1.124 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.204 1 FULL/DR 00:00:33 10.0.3.72 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.11 1 FULL/DR 00:00:33 10.0.4.39 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.208 1 FULL/DR 00:00:33 10.0.5.200 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.190 1 FULL/DR 00:00:33 10.0.4.254 GigabitEthernet0/2\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.253 1 FULL/DR 00:00:33 10.0.3.160 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.199 1 FULL/DR 00:00:33 10.0.4.117 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.5.61) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.5.61\nAdvertising Router: 10.0.5.61\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.203 1 FULL/DR 00:00:33 10.0.2.86 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.186 1 FULL/DR 00:00:33 10.0.1.186 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.254 1 FULL/DR 00:00:33 10.0.5.214 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.188 1 FULL/DR 00:00:33 10.0.1.196 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.16 1 FULL/DR 00:00:33 10.0.5.137 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.0.241) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.241\nAdvertising Router: 10.0.0.241\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.86 1 FULL/DR 00:00:33 10.0.1.21 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.140 1 FULL/DR 00:00:33 10.0.2.17 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.3.144) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.144\nAdvertising Router: 10.0.3.144\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.232 1 FULL/DR 00:00:33 10.0.1.2 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.169 1 FULL/DR 00:00:33 10.0.5.54 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.39 1 FULL/DR 00:00:33 10.0.5.116 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.55 1 FULL/DR 00:00:33 10.0.5.213 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.166 1 FULL/DR 00:00:33 10.0.5.174 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.2.126) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.126\nAdvertising Router: 10.0.2.126\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.200 1 FULL/DR 00:00:33 10.0.1.158 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.141 1 FULL/DR 00:00:33 10.0.4.186 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.47 1 FULL/DR 00:00:33 10.0.4.110 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.253 1 FULL/DR 00:00:33 10.0.2.20 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.4.251) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.251\nAdvertising Router: 10.0.4.251\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.117 1 FULL/DR 00:00:33 10.0.5.143 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.169 1 FULL/DR 00:00:33 10.0.2.15 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.153 1 FULL/DR 00:00:33 10.0.2.40 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.112 1 FULL/DR 00:00:33 10.0.5.79 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.165 1 FULL/DR 00:00:33 10.0.1.27 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.138 1 FULL/DR 00:00:33 10.0.4.219 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.127 1 FULL/DR 00:00:33 10.0.4.69 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.156 1 FULL/DR 00:00:33 10.0.2.196 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.185 1 FULL/DR 00:00:33 10.0.2.136 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.71 1 FULL/DR 00:00:33 10.0.2.198 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.147 1 FULL/DR 00:00:33 10.0.4.95 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.102 1 FULL/DR 00:00:33 10.0.1.196 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.63 1 FULL/DR 00:00:33 10.0.4.149 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.221 1 FULL/DR 00:00:33 10.0.5.190 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.59 1 FULL/DR 00:00:33 10.0.5.133 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.50 1 FULL/DR 00:00:33 10.0.3.113 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.110 1 FULL/DR 00:00:33 10.0.5.30 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.235 1 FULL/DR 00:00:33 10.0.2.65 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.16 1 FULL/DR 00:00:33 10.0.1.146 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.63 1 FULL/DR 00:00:33 10.0.3.105 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.92 1 FULL/DR 00:00:33 10.0.2.33 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.108 1 FULL/DR 00:00:33 10.0.5.137 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.131 1 FULL/DR 00:00:33 10.0.2.21 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.239 1 FULL/DR 00:00:33 10.0.1.183 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.240 1 FULL/DR 00:00:33 10.0.2.209 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.20 1 FULL/DR 00:00:33 10.0.2.52 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.220 1 FULL/DR 00:00:33 10.0.2.154 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.24 1 FULL/DR 00:00:33 10.0.1.224 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.218 1 FULL/DR 00:00:33 10.0.2.57 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.178 1 FULL/DR 00:00:33 10.0.2.69 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.64 1 FULL/DR 00:00:33 10.0.3.217 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.210 1 FULL/DR 00:00:33 10.0.1.53 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.46 1 FULL/DR 00:00:33 10.0.5.114 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.141 1 FULL/DR 00:00:33 10.0.5.99 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.110 1 FULL/DR 00:00:33 10.0.2.96 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.40 1 FULL/DR 00:00:33 10.0.4.9 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.92 1 FULL/DR 00:00:33 10.0.4.88 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.89 1 FULL/DR 00:00:33 10.0.1.162 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.7 1 FULL/DR 00:00:33 10.0.2.163 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.16 1 FULL/DR 00:00:33 10.0.2.107 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.0.233) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.233\nAdvertising Router: 10.0.0.233\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.245 1 FULL/DR 00:00:33 10.0.3.108 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.180 1 FULL/DR 00:00:33 10.0.4.54 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.108 1 FULL/DR 00:00:33 10.0.5.46 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.132 1 FULL/DR 00:00:33 10.0.1.214 GigabitEthernet0/2\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.249 1 FULL/DR 00:00:33 10.0.1.182 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.4.69) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.69\nAdvertising Router: 10.0.4.69\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.171 1 FULL/DR 00:00:33 10.0.2.147 GigabitEthernet0/2\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.7 1 FULL/DR 00:00:33 10.0.3.254 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.157 1 FULL/DR 00:00:33 10.0.2.221 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.0.96) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.96\nAdvertising Router: 10.0.0.96\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.185 1 FULL/DR 00:00:33 10.0.2.106 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.193 1 FULL/DR 00:00:33 10.0.2.19 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.211 1 FULL/DR 00:00:33 10.0.5.236 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.209 1 FULL/DR 00:00:33 10.0.4.25 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.3.179) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.179\nAdvertising Router: 10.0.3.179\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.218 1 FULL/DR 00:00:33 10.0.3.196 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.238 1 FULL/DR 00:00:33 10.0.4.120 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.37 1 FULL/DR 00:00:33 10.0.1.184 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.199 1 FULL/DR 00:00:33 10.0.3.94 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.76 1 FULL/DR 00:00:33 10.0.2.219 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.193 1 FULL/DR 00:00:33 10.0.3.204 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.175 1 FULL/DR 00:00:33 10.0.1.187 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.241 1 FULL/DR 00:00:33 10.0.4.166 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.188 1 FULL/DR 00:00:33 10.0.3.57 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.3 1 FULL/DR 00:00:33 10.0.2.207 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.177 1 FULL/DR 00:00:33 10.0.1.78 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.0.26) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.26\nAdvertising Router: 10.0.0.26\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.177 1 FULL/DR 00:00:33 10.0.1.64 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.98 1 FULL/DR 00:00:33 10.0.1.116 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.6 1 FULL/DR 00:00:33 10.0.5.151 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.4.182) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.182\nAdvertising Router: 10.0.4.182\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.54 1 FULL/DR 00:00:33 10.0.1.235 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.192 1 FULL/DR 00:00:33 10.0.4.187 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.190 1 FULL/DR 00:00:33 10.0.3.128 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.180 1 FULL/DR 00:00:33 10.0.4.248 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.87 1 FULL/DR 00:00:33 10.0.3.24 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.143 1 FULL/DR 00:00:33 10.0.3.104 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.225 1 FULL/DR 00:00:33 10.0.5.65 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.118 1 FULL/DR 00:00:33 10.0.1.41 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.9 1 FULL/DR 00:00:33 10.0.2.254 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.144 1 FULL/DR 00:00:33 10.0.2.99 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.117 1 FULL/DR 00:00:33 10.0.4.252 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.70 1 FULL/DR 00:00:33 10.0.5.88 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.216 1 FULL/DR 00:00:33 10.0.1.99 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.52 1 FULL/DR 00:00:33 10.0.3.238 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.204 1 FULL/DR 00:00:33 10.0.3.163 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.217 1 FULL/DR 00:00:33 10.0.1.163 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.164 1 FULL/DR 00:00:33 10.0.3.91 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.23 1 FULL/DR 00:00:33 10.0.2.193 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.47 1 FULL/DR 00:00:33 10.0.4.40 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.224 1 FULL/DR 00:00:33 10.0.3.135 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.224 1 FULL/DR 00:00:33 10.0.2.97 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.146 1 FULL/DR 00:00:33 10.0.3.227 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.63 1 FULL/DR 00:00:33 10.0.2.204 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.148 1 FULL/DR 00:00:33 10.0.1.41 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.155 1 FULL/DR 00:00:33 10.0.4.25 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.75 1 FULL/DR 00:00:33 10.0.5.118 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.10 1 FULL/DR 00:00:33 10.0.2.145 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.166 1 FULL/DR 00:00:33 10.0.2.222 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.80 1 FULL/DR 00:00:33 10.0.1.191 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.55 1 FULL/DR 00:00:33 10.0.2.169 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.106 1 FULL/DR 00:00:33 10.0.3.29 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.61 1 FULL/DR 00:00:33 10.0.5.134 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.174 1 FULL/DR 00:00:33 10.0.3.212 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.221 1 FULL/DR 00:00:33 10.0.3.141 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.3.51) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.51\nAdvertising Router: 10.0.3.51\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.175 1 FULL/DR 00:00:33 10.0.3.7 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.147 1 FULL/DR 00:00:33 10.0.4.68 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.189 1 FULL/DR 00:00:33 10.0.4.16 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.196 1 FULL/DR 00:00:33 10.0.2.233 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.3.173) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.173\nAdvertising Router: 10.0.3.173\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.180 1 FULL/DR 00:00:33 10.0.5.228 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.53 1 FULL/DR 00:00:33 10.0.4.4 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.163 1 FULL/DR 00:00:33 10.0.1.89 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.156 1 FULL/DR 00:00:33 10.0.3.134 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.1 1 FULL/DR 00:00:33 10.0.4.209 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.203 1 FULL/DR 00:00:33 10.0.3.11 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.2.146) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.146\nAdvertising Router: 10.0.2.146\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.35 1 FULL/DR 00:00:33 10.0.1.168 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.107 1 FULL/DR 00:00:33 10.0.1.28 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.217 1 FULL/DR 00:00:33 10.0.2.227 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.56 1 FULL/DR 00:00:33 10.0.4.145 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.197 1 FULL/DR 00:00:33 10.0.5.127 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.235 1 FULL/DR 00:00:33 10.0.2.244 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.65 1 FULL/DR 00:00:33 10.0.5.244 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.233 1 FULL/DR 00:00:33 10.0.1.123 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.76 1 FULL/DR 00:00:33 10.0.4.93 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.189 1 FULL/DR 00:00:33 10.0.1.46 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.109 1 FULL/DR 00:00:33 10.0.4.148 GigabitEthernet0/2\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.177 1 FULL/DR 00:00:33 10.0.1.171 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.175 1 FULL/DR 00:00:33 10.0.1.221 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.0.162) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.162\nAdvertising Router: 10.0.0.162\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.12 1 FULL/DR 00:00:33 10.0.3.68 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.72 1 FULL/DR 00:00:33 10.0.1.19 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.237 1 FULL/DR 00:00:33 10.0.2.246 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.235 1 FULL/DR 00:00:33 10.0.4.205 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.4 1 FULL/DR 00:00:33 10.0.5.131 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.153 1 FULL/DR 00:00:33 10.0.5.2 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.5.30) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.5.30\nAdvertising Router: 10.0.5.30\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.75 1 FULL/DR 00:00:33 10.0.1.217 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.172 1 FULL/DR 00:00:33 10.0.3.178 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.105 1 FULL/DR 00:00:33 10.0.3.180 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.166 1 FULL/DR 00:00:33 10.0.4.24 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.193 1 FULL/DR 00:00:33 10.0.5.49 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.3 1 FULL/DR 00:00:33 10.0.1.220 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.19 1 FULL/DR 00:00:33 10.0.1.195 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.90 1 FULL/DR 00:00:33 10.0.5.118 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.77 1 FULL/DR 00:00:33 10.0.1.210 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.23 1 FULL/DR 00:00:33 10.0.3.66 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.163 1 FULL/DR 00:00:33 10.0.1.193 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.156 1 FULL/DR 00:00:33 10.0.5.244 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.249 1 FULL/DR 00:00:33 10.0.5.225 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.111 1 FULL/DR 00:00:33 10.0.3.242 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.37 1 FULL/DR 00:00:33 10.0.2.161 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.195 1 FULL/DR 00:00:33 10.0.2.93 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.53 1 FULL/DR 00:00:33 10.0.2.207 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.19 1 FULL/DR 00:00:33 10.0.2.159 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.207 1 FULL/DR 00:00:33 10.0.3.164 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.224 1 FULL/DR 00:00:33 10.0.5.241 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.95 1 FULL/DR 00:00:33 10.0.1.36 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.13 1 FULL/DR 00:00:33 10.0.3.246 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.95 1 FULL/DR 00:00:33 10.0.2.142 GigabitEthernet0/2\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.121 1 FULL/DR 00:00:33 10.0.3.216 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.121 1 FULL/DR 00:00:33 10.0.4.181 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.130 1 FULL/DR 00:00:33 10.0.1.32 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.161 1 FULL/DR 00:00:33 10.0.1.9 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.5.186) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.5.186\nAdvertising Router: 10.0.5.186\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.83 1 FULL/DR 00:00:33 10.0.4.205 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.21 1 FULL/DR 00:00:33 10.0.5.132 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.99 1 FULL/DR 00:00:33 10.0.5.152 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.42 1 FULL/DR 00:00:33 10.0.2.237 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.146 1 FULL/DR 00:00:33 10.0.1.97 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.225 1 FULL/DR 00:00:33 10.0.4.238 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.78 1 FULL/DR 00:00:33 10.0.2.192 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.4.57) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.57\nAdvertising Router: 10.0.4.57\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.51 1 FULL/DR 00:00:33 10.0.5.120 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.9 1 FULL/DR 00:00:33 10.0.3.197 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.152 1 FULL/DR 00:00:33 10.0.5.142 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.192 1 FULL/DR 00:00:33 10.0.5.191 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.88 1 FULL/DR 00:00:33 10.0.5.244 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.199 1 FULL/DR 00:00:33 10.0.2.143 GigabitEthernet0/2\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.235 1 FULL/DR 00:00:33 10.0.5.239 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.102 1 FULL/DR 00:00:33 10.0.1.141 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.136 1 FULL/DR 00:00:33 10.0.5.193 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.124 1 FULL/DR 00:00:33 10.0.5.137 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.33 1 FULL/DR 00:00:33 10.0.4.200 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.194 1 FULL/DR 00:00:33 10.0.3.70 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.147 1 FULL/DR 00:00:33 10.0.1.91 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.12 1 FULL/DR 00:00:33 10.0.2.11 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.151 1 FULL/DR 00:00:33 10.0.5.254 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.222 1 FULL/DR 00:00:33 10.0.5.128 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.1.116) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.116\nAdvertising Router: 10.0.1.116\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.29 1 FULL/DR 00:00:33 10.0.1.226 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.91 1 FULL/DR 00:00:33 10.0.4.218 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.199 1 FULL/DR 00:00:33 10.0.4.193 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.239 1 FULL/DR 00:00:33 10.0.5.162 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.226 1 FULL/DR 00:00:33 10.0.5.205 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Authentication type/key mismatch with neighbor\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.110 1 FULL/DR 00:00:33 10.0.2.98 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Authentication mismatch.", "root_cause": "Root cause related to: Authentication mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.121 1 FULL/DR 00:00:33 10.0.4.217 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Passive interface enabled.", "root_cause": "Root cause related to: Passive interface enabled.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.183 1 FULL/DR 00:00:33 10.0.3.47 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.2.136) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.136\nAdvertising Router: 10.0.2.136\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.230 1 FULL/DR 00:00:33 10.0.2.158 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Mismatched area ID with neighbor (1)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.129 1 FULL/DR 00:00:33 10.0.2.235 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Area mismatch.", "root_cause": "Root cause related to: Area mismatch.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.142 1 FULL/DR 00:00:33 10.0.5.4 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.203 1 FULL/DR 00:00:33 10.0.5.235 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.4.206) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.206\nAdvertising Router: 10.0.4.206\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.4 1 FULL/DR 00:00:33 10.0.3.89 GigabitEthernet0/0\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.53 1 FULL/DR 00:00:33 10.0.2.91 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.3.232) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.232\nAdvertising Router: 10.0.3.232\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.232 1 FULL/DR 00:00:33 10.0.5.168 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.208 1 FULL/DR 00:00:33 10.0.1.64 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in 2-Way.", "root_cause": "Root cause related to: Stuck in 2-Way.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.118 1 FULL/DR 00:00:33 10.0.4.232 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.4.201) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.201\nAdvertising Router: 10.0.4.201\nLS Seq Number: 80000A3A\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in EXCHANGE.", "root_cause": "Root cause related to: Stuck in EXCHANGE.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.175 1 FULL/DR 00:00:33 10.0.2.188 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.112 1 FULL/DR 00:00:33 10.0.4.122 GigabitEthernet0/1\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF issue: LSDB desync.", "root_cause": "Root cause related to: LSDB desync.", "local_fix_cli": ["clear ip ospf process"], "neighbor_fix_cli": ["clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.163 1 FULL/DR 00:00:33 10.0.5.16 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.103 1 FULL/DR 00:00:33 10.0.3.20 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.120 1 FULL/DR 00:00:33 10.0.5.240 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor hello 5, dead 20 (mismatch)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.228 1 FULL/DR 00:00:33 10.0.2.210 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Hello/dead timer mismatch.", "root_cause": "Root cause related to: Hello/dead timer mismatch.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "CORE-R1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.235 1 FULL/DR 00:00:33 10.0.1.195 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Missing network statement.", "root_cause": "Root cause related to: Missing network statement.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.151 1 FULL/DR 00:00:33 10.0.1.119 GigabitEthernet0/1\n"}, "expected_output": {"diagnosis": "OSPF issue: Stuck in INIT.", "root_cause": "Root cause related to: Stuck in INIT.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n"}, "expected_output": {"diagnosis": "OSPF issue: OSPF neighbor down.", "root_cause": "Root cause related to: OSPF neighbor down.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.39 1 FULL/DR 00:00:33 10.0.4.107 GigabitEthernet0/0\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.28 1 FULL/DR 00:00:33 10.0.4.11 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: Router-ID conflict.", "root_cause": "Root cause related to: Router-ID conflict.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n MTU mismatch detected with neighbor (1400 bytes)\n", "show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.61 1 FULL/DR 00:00:33 10.0.1.6 GigabitEthernet0/2\n"}, "expected_output": {"diagnosis": "OSPF issue: EXSTART MTU mismatch.", "root_cause": "Root cause related to: EXSTART MTU mismatch.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}}