{"instruction": "Wazuh detected event 'excessive broadcast traffic' on device CORE-R1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.128.55.26", "event": "excessive broadcast traffic", "severity": "high"}, "requested_show": ["show mac address-table", "show ip traffic", "show interfaces input-errors", "show interfaces counters", "show logging | include STORM", "show spanning-tree"]}
{"instruction": "Wazuh detected event 'excessive broadcast traffic' on device ACCESS-SW2 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.161.65.34", "event": "excessive broadcast traffic", "severity": "high"}, "requested_show": ["show ip traffic", "show interfaces input-errors", "show interfaces counters", "show spanning-tree", "show logging | include STORM"]}
{"instruction": "Wazuh detected event 'excessive broadcast traffic' on device ACCESS-SW2 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.65.41.238", "event": "excessive broadcast traffic", "severity": "high"}, "requested_show": ["show interfaces input-errors", "show ip traffic", "show interfaces counters", "show spanning-tree", "show mac address-table"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device ACCESS-SW2 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.143.242.108", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show ip ospf interface", "show ip ospf neighbor", "show logging | include OSPF", "show interfaces", "show ip ospf database"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device ACCESS-SW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.55.216.4", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show interfaces", "show logging | include ARP", "show arp", "show mac address-table", "show ip verify source"]}
{"instruction": "Wazuh detected event 'port scan detected' on device EDGE-FW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.169.107.166", "event": "port scan detected", "severity": "high"}, "requested_show": ["show conn", "show ip traffic", "show logging | include DENY", "show firewall", "show ip interface brief"]}
{"instruction": "Wazuh detected event 'spanning tree loop detected' on device BRANCH-RTR1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.240.142.81", "event": "spanning tree loop detected", "severity": "critical"}, "requested_show": ["show spanning-tree", "show interfaces counters errors", "show spanning-tree detail", "show lldp neighbors", "show logging | include STP", "show mac address-table move"]}
{"instruction": "Wazuh detected event 'excessive broadcast traffic' on device BRANCH-RTR1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.19.149.145", "event": "excessive broadcast traffic", "severity": "low"}, "requested_show": ["show spanning-tree", "show interfaces counters", "show mac address-table", "show ip traffic", "show interfaces input-errors", "show logging | include STORM"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device EDGE-FW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.251.64.62", "event": "dns exfiltration suspected", "severity": "high"}, "requested_show": ["show access-lists", "show interfaces", "show conn address", "show ip dns view", "show logging | include DNS"]}
{"instruction": "Wazuh detected event 'interface flapping' on device ACCESS-SW2 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.190.94.158", "event": "interface flapping", "severity": "low"}, "requested_show": ["show interfaces", "show interfaces counters errors", "show controllers", "show logging | include LINK", "show spanning-tree interface", "show interfaces status"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device BRANCH-RTR1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.154.135.108", "event": "dns exfiltration suspected", "severity": "high"}, "requested_show": ["show interfaces", "show ip traffic", "show logging | include DNS", "show ip dns view", "show conn address"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device EDGE-FW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.252.72.214", "event": "failed login attempts", "severity": "critical"}, "requested_show": ["show logging | include LOGIN", "show aaa servers", "show users", "show running-config | include username", "show ip ssh", "show accounting"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device CORE-R1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.113.151.44", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show arp", "show ip traffic", "show logging | include ARP", "show mac address-table", "show interfaces", "show ip verify source"]}
{"instruction": "Wazuh detected event 'blacklisted ip communication' on device CORE-R1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.193.255.168", "event": "blacklisted ip communication", "severity": "critical"}, "requested_show": ["show access-lists", "show logging | include DENY", "show ip traffic", "show conn address", "show interfaces", "show ip route"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device ACCESS-SW2 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.12.25.122", "event": "high cpu usage", "severity": "medium"}, "requested_show": ["show platform resources", "show logging | include CPU", "show memory statistics", "show processes cpu sorted", "show interfaces counters errors", "show processes memory sorted"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device CORE-R1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.203.202.167", "event": "dns exfiltration suspected", "severity": "medium"}, "requested_show": ["show access-lists", "show ip traffic", "show ip dns view", "show logging | include DNS", "show conn address"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device ACCESS-SW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.118.167.248", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show crypto ipsec sa", "show ip route", "show crypto ikev2 sa", "show interfaces", "show logging | include VPN", "show crypto session"]}
{"instruction": "Wazuh detected event 'excessive broadcast traffic' on device EDGE-FW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.204.61.176", "event": "excessive broadcast traffic", "severity": "high"}, "requested_show": ["show logging | include STORM", "show spanning-tree", "show interfaces input-errors", "show mac address-table", "show interfaces counters"]}
{"instruction": "Wazuh detected event 'port scan detected' on device EDGE-FW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.23.137.82", "event": "port scan detected", "severity": "high"}, "requested_show": ["show ip interface brief", "show access-lists", "show conn", "show ip traffic", "show logging | include DENY", "show firewall"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device ACCESS-SW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.144.104.126", "event": "failed login attempts", "severity": "critical"}, "requested_show": ["show users", "show accounting", "show ip ssh", "show running-config | include username", "show logging | include LOGIN", "show aaa servers"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device ACCESS-SW1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.32.219.141", "event": "dhcp starvation attack", "severity": "low"}, "requested_show": ["show ip dhcp pool", "show logging | include DHCP", "show mac address-table", "show ip traffic", "show ip dhcp conflict"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device CORE-R1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.234.90.182", "event": "dhcp starvation attack", "severity": "high"}, "requested_show": ["show ip dhcp conflict", "show ip traffic", "show ip dhcp pool", "show mac address-table", "show logging | include DHCP", "show ip dhcp binding"]}
{"instruction": "Wazuh detected event 'interface flapping' on device ACCESS-SW2 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.18.172.123", "event": "interface flapping", "severity": "low"}, "requested_show": ["show interfaces counters errors", "show controllers", "show logging | include LINK", "show interfaces status", "show interfaces"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device EDGE-FW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.238.13.215", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show ip ospf neighbor", "show ip ospf interface", "show logging | include OSPF", "show interfaces", "show ip ospf database", "show ip route ospf"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device EDGE-FW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.90.101.220", "event": "failed login attempts", "severity": "critical"}, "requested_show": ["show running-config | include username", "show logging | include LOGIN", "show aaa servers", "show users", "show accounting"]}
{"instruction": "Wazuh detected event 'blacklisted ip communication' on device CORE-R1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.197.49.185", "event": "blacklisted ip communication", "severity": "high"}, "requested_show": ["show ip traffic", "show logging | include DENY", "show access-lists", "show interfaces", "show ip route"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device CORE-R1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.59.229.175", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show ip ospf interface", "show interfaces", "show ip ospf database", "show ip ospf neighbor", "show ip route ospf", "show logging | include OSPF"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device ACCESS-SW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.195.68.85", "event": "dns exfiltration suspected", "severity": "medium"}, "requested_show": ["show logging | include DNS", "show interfaces", "show ip dns view", "show ip traffic", "show access-lists", "show conn address"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device EDGE-FW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.255.162.182", "event": "high cpu usage", "severity": "medium"}, "requested_show": ["show logging | include CPU", "show memory statistics", "show processes cpu sorted", "show interfaces counters errors", "show platform resources"]}
{"instruction": "Wazuh detected event 'port scan detected' on device ACCESS-SW2 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.158.77.48", "event": "port scan detected", "severity": "medium"}, "requested_show": ["show firewall", "show logging | include DENY", "show access-lists", "show conn", "show ip interface brief", "show ip traffic"]}
{"instruction": "Wazuh detected event 'ssh brute-force' on device ACCESS-SW2 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.248.202.240", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show access-lists", "show running-config | include line vty", "show users", "show ip ssh", "show logging | include SSH", "show ip interface brief"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device ACCESS-SW2 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.47.181.186", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show crypto ipsec sa", "show crypto ikev2 sa", "show interfaces", "show ip route", "show logging | include VPN"]}
{"instruction": "Wazuh detected event 'spanning tree loop detected' on device ACCESS-SW2 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.51.51.125", "event": "spanning tree loop detected", "severity": "medium"}, "requested_show": ["show lldp neighbors", "show mac address-table move", "show spanning-tree detail", "show spanning-tree", "show logging | include STP", "show interfaces counters errors"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device EDGE-FW1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.179.100.53", "event": "arp spoofing suspected", "severity": "low"}, "requested_show": ["show interfaces", "show ip traffic", "show arp", "show logging | include ARP", "show mac address-table"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device CORE-R1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.84.238.28", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show ip ospf neighbor", "show logging | include OSPF", "show ip ospf database", "show ip route ospf", "show ip ospf interface"]}
{"instruction": "Wazuh detected event 'bgp session flap' on device CORE-R1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.95.174.94", "event": "bgp session flap", "severity": "critical"}, "requested_show": ["show ip route", "show ip cef", "show ip bgp summary", "show interfaces counters errors", "show ip bgp neighbors"]}
{"instruction": "Wazuh detected event 'ssh brute-force' on device BRANCH-RTR1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.173.18.207", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show ip ssh", "show users", "show access-lists", "show ip interface brief", "show logging | include SSH"]}
{"instruction": "Wazuh detected event 'acl blocking legitimate traffic' on device ACCESS-SW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.254.221.247", "event": "acl blocking legitimate traffic", "severity": "medium"}, "requested_show": ["show ip route", "show access-lists", "show logging | include DENY", "show ip interface", "show conn"]}
{"instruction": "Wazuh detected event 'port scan detected' on device BRANCH-RTR1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.89.78.37", "event": "port scan detected", "severity": "critical"}, "requested_show": ["show conn", "show ip interface brief", "show firewall", "show access-lists", "show logging | include DENY"]}
{"instruction": "Wazuh detected event 'port scan detected' on device ACCESS-SW2 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.53.70.249", "event": "port scan detected", "severity": "high"}, "requested_show": ["show firewall", "show conn", "show logging | include DENY", "show access-lists", "show ip interface brief"]}
{"instruction": "Wazuh detected event 'ssh brute-force' on device EDGE-FW1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.201.198.17", "event": "ssh brute-force", "severity": "low"}, "requested_show": ["show running-config | include line vty", "show ip ssh", "show users", "show ip interface brief", "show access-lists", "show logging | include SSH"]}
{"instruction": "Wazuh detected event 'bgp session flap' on device BRANCH-RTR1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.154.186.205", "event": "bgp session flap", "severity": "medium"}, "requested_show": ["show interfaces counters errors", "show logging | include BGP", "show ip route", "show ip bgp summary", "show ip bgp neighbors", "show ip cef"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device BRANCH-RTR1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.4.63.138", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show crypto ikev2 sa", "show ip route", "show crypto session", "show interfaces", "show logging | include VPN"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device CORE-R1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.216.19.157", "event": "failed login attempts", "severity": "medium"}, "requested_show": ["show ip ssh", "show logging | include LOGIN", "show users", "show aaa servers", "show accounting", "show running-config | include username"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device EDGE-FW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.113.45.92", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show logging | include CPU", "show interfaces counters errors", "show processes memory sorted", "show processes cpu sorted", "show platform resources"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device ACCESS-SW2 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.205.181.222", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show ip ospf interface", "show ip route ospf", "show ip ospf database", "show ip ospf neighbor", "show logging | include OSPF"]}
{"instruction": "Wazuh detected event 'acl blocking legitimate traffic' on device CORE-R1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.77.96.250", "event": "acl blocking legitimate traffic", "severity": "critical"}, "requested_show": ["show ip route", "show logging | include DENY", "show access-lists", "show running-config | section access-list", "show conn", "show ip interface"]}
{"instruction": "Wazuh detected event 'acl blocking legitimate traffic' on device BRANCH-RTR1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.123.147.241", "event": "acl blocking legitimate traffic", "severity": "medium"}, "requested_show": ["show ip route", "show conn", "show access-lists", "show ip interface", "show running-config | section access-list", "show logging | include DENY"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device EDGE-FW1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.110.31.174", "event": "vpn tunnel down", "severity": "low"}, "requested_show": ["show crypto ikev2 sa", "show logging | include VPN", "show crypto ipsec sa", "show interfaces", "show ip route"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device EDGE-FW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.139.23.200", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show arp", "show mac address-table", "show logging | include ARP", "show ip verify source", "show interfaces", "show ip traffic"]}
{"instruction": "Wazuh detected event 'blacklisted ip communication' on device BRANCH-RTR1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.228.184.217", "event": "blacklisted ip communication", "severity": "high"}, "requested_show": ["show interfaces", "show ip traffic", "show ip route", "show access-lists", "show logging | include DENY", "show conn address"]}
{"instruction": "Wazuh detected event 'blacklisted ip communication' on device ACCESS-SW2 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.232.63.100", "event": "blacklisted ip communication", "severity": "medium"}, "requested_show": ["show interfaces", "show ip traffic", "show logging | include DENY", "show ip route", "show conn address", "show access-lists"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device ACCESS-SW1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.176.182.73", "event": "vpn tunnel down", "severity": "low"}, "requested_show": ["show ip route", "show crypto ipsec sa", "show interfaces", "show crypto ikev2 sa", "show crypto session"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device CORE-R1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.163.80.230", "event": "dhcp starvation attack", "severity": "critical"}, "requested_show": ["show ip dhcp conflict", "show ip dhcp binding", "show mac address-table", "show logging | include DHCP", "show ip dhcp pool"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device CORE-R1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.95.128.17", "event": "failed login attempts", "severity": "medium"}, "requested_show": ["show logging | include LOGIN", "show running-config | include username", "show ip ssh", "show accounting", "show users"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device ACCESS-SW2 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.27.20.206", "event": "ospf neighbor down", "severity": "medium"}, "requested_show": ["show ip ospf interface", "show ip route ospf", "show ip ospf database", "show interfaces", "show logging | include OSPF", "show ip ospf neighbor"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device BRANCH-RTR1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.101.216.59", "event": "failed login attempts", "severity": "critical"}, "requested_show": ["show users", "show accounting", "show logging | include LOGIN", "show running-config | include username", "show ip ssh", "show aaa servers"]}
{"instruction": "Wazuh detected event 'acl blocking legitimate traffic' on device ACCESS-SW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.108.180.177", "event": "acl blocking legitimate traffic", "severity": "critical"}, "requested_show": ["show ip interface", "show conn", "show access-lists", "show logging | include DENY", "show ip route"]}
{"instruction": "Wazuh detected event 'blacklisted ip communication' on device ACCESS-SW2 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.182.2.71", "event": "blacklisted ip communication", "severity": "high"}, "requested_show": ["show conn address", "show ip route", "show logging | include DENY", "show access-lists", "show ip traffic", "show interfaces"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device EDGE-FW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.169.91.115", "event": "failed login attempts", "severity": "critical"}, "requested_show": ["show ip ssh", "show users", "show aaa servers", "show accounting", "show logging | include LOGIN"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device ACCESS-SW2 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.159.55.111", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show interfaces", "show logging | include VPN", "show ip route", "show crypto session", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device ACCESS-SW2 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.115.104.63", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show interfaces counters errors", "show platform resources", "show logging | include CPU", "show processes memory sorted", "show memory statistics", "show processes cpu sorted"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device BRANCH-RTR1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.227.110.166", "event": "failed login attempts", "severity": "medium"}, "requested_show": ["show logging | include LOGIN", "show running-config | include username", "show accounting", "show ip ssh", "show users", "show aaa servers"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device BRANCH-RTR1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.173.148.247", "event": "high cpu usage", "severity": "critical"}, "requested_show": ["show processes memory sorted", "show logging | include CPU", "show interfaces counters errors", "show processes cpu sorted", "show platform resources", "show memory statistics"]}
{"instruction": "Wazuh detected event 'ssh brute-force' on device EDGE-FW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.143.119.28", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show logging | include SSH", "show access-lists", "show ip interface brief", "show users", "show ip ssh"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device EDGE-FW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.67.49.56", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show ip route", "show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces", "show logging | include VPN", "show crypto session"]}
{"instruction": "Wazuh detected event 'excessive broadcast traffic' on device ACCESS-SW2 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.167.218.128", "event": "excessive broadcast traffic", "severity": "high"}, "requested_show": ["show spanning-tree", "show logging | include STORM", "show ip traffic", "show interfaces counters", "show mac address-table", "show interfaces input-errors"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device ACCESS-SW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.215.50.122", "event": "failed login attempts", "severity": "medium"}, "requested_show": ["show running-config | include username", "show accounting", "show logging | include LOGIN", "show aaa servers", "show ip ssh"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device ACCESS-SW2 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.133.121.12", "event": "dhcp starvation attack", "severity": "critical"}, "requested_show": ["show logging | include DHCP", "show ip dhcp conflict", "show ip dhcp pool", "show ip dhcp binding", "show ip traffic", "show mac address-table"]}
{"instruction": "Wazuh detected event 'excessive broadcast traffic' on device ACCESS-SW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.211.137.19", "event": "excessive broadcast traffic", "severity": "high"}, "requested_show": ["show interfaces counters", "show ip traffic", "show interfaces input-errors", "show logging | include STORM", "show mac address-table"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device ACCESS-SW2 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.210.138.179", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show crypto ipsec sa", "show interfaces", "show ip route", "show logging | include VPN", "show crypto session", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device CORE-R1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.153.123.127", "event": "dhcp starvation attack", "severity": "high"}, "requested_show": ["show ip dhcp pool", "show ip traffic", "show ip dhcp binding", "show ip dhcp conflict", "show mac address-table", "show logging | include DHCP"]}
{"instruction": "Wazuh detected event 'spanning tree loop detected' on device ACCESS-SW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.31.42.195", "event": "spanning tree loop detected", "severity": "critical"}, "requested_show": ["show logging | include STP", "show lldp neighbors", "show interfaces counters errors", "show spanning-tree", "show mac address-table move"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device CORE-R1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.253.66.48", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show interfaces", "show ip ospf interface", "show logging | include OSPF", "show ip route ospf", "show ip ospf neighbor", "show ip ospf database"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device BRANCH-RTR1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.94.152.71", "event": "dhcp starvation attack", "severity": "medium"}, "requested_show": ["show ip dhcp binding", "show mac address-table", "show ip dhcp pool", "show logging | include DHCP", "show ip traffic"]}
{"instruction": "Wazuh detected event 'acl blocking legitimate traffic' on device EDGE-FW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.159.13.174", "event": "acl blocking legitimate traffic", "severity": "critical"}, "requested_show": ["show ip interface", "show ip route", "show conn", "show running-config | section access-list", "show access-lists", "show logging | include DENY"]}
{"instruction": "Wazuh detected event 'bgp session flap' on device EDGE-FW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.229.45.243", "event": "bgp session flap", "severity": "critical"}, "requested_show": ["show ip cef", "show logging | include BGP", "show interfaces counters errors", "show ip route", "show ip bgp neighbors", "show ip bgp summary"]}
{"instruction": "Wazuh detected event 'bgp session flap' on device BRANCH-RTR1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.161.200.154", "event": "bgp session flap", "severity": "medium"}, "requested_show": ["show ip bgp summary", "show ip route", "show ip cef", "show ip bgp neighbors", "show interfaces counters errors"]}
{"instruction": "Wazuh detected event 'port scan detected' on device ACCESS-SW1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.153.42.115", "event": "port scan detected", "severity": "low"}, "requested_show": ["show ip traffic", "show ip interface brief", "show conn", "show access-lists", "show firewall", "show logging | include DENY"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device CORE-R1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.21.131.70", "event": "dns exfiltration suspected", "severity": "high"}, "requested_show": ["show conn address", "show interfaces", "show logging | include DNS", "show ip traffic", "show ip dns view", "show access-lists"]}
{"instruction": "Wazuh detected event 'ssh brute-force' on device EDGE-FW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.8.235.103", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show ip interface brief", "show access-lists", "show ip ssh", "show users", "show logging | include SSH"]}
{"instruction": "Wazuh detected event 'port scan detected' on device CORE-R1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.91.70.76", "event": "port scan detected", "severity": "high"}, "requested_show": ["show access-lists", "show firewall", "show ip traffic", "show ip interface brief", "show conn", "show logging | include DENY"]}
{"instruction": "Wazuh detected event 'acl blocking legitimate traffic' on device CORE-R1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.103.8.25", "event": "acl blocking legitimate traffic", "severity": "critical"}, "requested_show": ["show ip route", "show logging | include DENY", "show conn", "show running-config | section access-list", "show access-lists"]}
{"instruction": "Wazuh detected event 'spanning tree loop detected' on device CORE-R1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.132.24.210", "event": "spanning tree loop detected", "severity": "medium"}, "requested_show": ["show logging | include STP", "show spanning-tree detail", "show lldp neighbors", "show mac address-table move", "show spanning-tree", "show interfaces counters errors"]}
{"instruction": "Wazuh detected event 'interface flapping' on device ACCESS-SW1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.233.218.219", "event": "interface flapping", "severity": "low"}, "requested_show": ["show interfaces status", "show controllers", "show interfaces", "show logging | include LINK", "show spanning-tree interface"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device ACCESS-SW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.254.108.5", "event": "vpn tunnel down", "severity": "critical"}, "requested_show": ["show ip route", "show logging | include VPN", "show crypto ikev2 sa", "show crypto session", "show crypto ipsec sa", "show interfaces"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device ACCESS-SW2 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.221.130.68", "event": "high cpu usage", "severity": "critical"}, "requested_show": ["show memory statistics", "show processes cpu sorted", "show logging | include CPU", "show processes memory sorted", "show interfaces counters errors"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device ACCESS-SW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.128.125.25", "event": "dns exfiltration suspected", "severity": "medium"}, "requested_show": ["show conn address", "show ip traffic", "show interfaces", "show access-lists", "show logging | include DNS"]}
{"instruction": "Wazuh detected event 'bgp session flap' on device BRANCH-RTR1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.95.16.11", "event": "bgp session flap", "severity": "high"}, "requested_show": ["show ip route", "show interfaces counters errors", "show logging | include BGP", "show ip bgp summary", "show ip cef", "show ip bgp neighbors"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device ACCESS-SW2 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.38.23.134", "event": "vpn tunnel down", "severity": "low"}, "requested_show": ["show ip route", "show crypto ikev2 sa", "show crypto ipsec sa", "show crypto session", "show logging | include VPN", "show interfaces"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device EDGE-FW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.106.137.79", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show ip ospf interface", "show ip ospf neighbor", "show interfaces", "show logging | include OSPF", "show ip route ospf", "show ip ospf database"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device EDGE-FW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.153.170.81", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show ip ospf neighbor", "show ip ospf database", "show interfaces", "show ip route ospf", "show logging | include OSPF"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device ACCESS-SW2 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.199.190.110", "event": "arp spoofing suspected", "severity": "critical"}, "requested_show": ["show interfaces", "show ip verify source", "show arp", "show ip traffic", "show mac address-table", "show logging | include ARP"]}
{"instruction": "Wazuh detected event 'port scan detected' on device ACCESS-SW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.36.122.225", "event": "port scan detected", "severity": "high"}, "requested_show": ["show access-lists", "show logging | include DENY", "show ip traffic", "show conn", "show firewall"]}
{"instruction": "Wazuh detected event 'spanning tree loop detected' on device ACCESS-SW2 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.137.133.176", "event": "spanning tree loop detected", "severity": "high"}, "requested_show": ["show spanning-tree", "show spanning-tree detail", "show mac address-table move", "show lldp neighbors", "show logging | include STP", "show interfaces counters errors"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device BRANCH-RTR1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.129.16.131", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show crypto ipsec sa", "show ip route", "show crypto ikev2 sa", "show interfaces", "show logging | include VPN", "show crypto session"]}
{"instruction": "Wazuh detected event 'interface flapping' on device ACCESS-SW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.155.138.46", "event": "interface flapping", "severity": "critical"}, "requested_show": ["show interfaces counters errors", "show spanning-tree interface", "show controllers", "show interfaces", "show interfaces status", "show logging | include LINK"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device BRANCH-RTR1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.210.104.116", "event": "dhcp starvation attack", "severity": "high"}, "requested_show": ["show logging | include DHCP", "show ip dhcp pool", "show ip traffic", "show ip dhcp conflict", "show mac address-table", "show ip dhcp binding"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device EDGE-FW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.214.176.57", "event": "dns exfiltration suspected", "severity": "high"}, "requested_show": ["show conn address", "show ip traffic", "show logging | include DNS", "show access-lists", "show interfaces", "show ip dns view"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device EDGE-FW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.57.250.43", "event": "high cpu usage", "severity": "medium"}, "requested_show": ["show memory statistics", "show platform resources", "show processes cpu sorted", "show logging | include CPU", "show interfaces counters errors"]}
{"instruction": "Wazuh detected event 'excessive broadcast traffic' on device EDGE-FW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.71.139.30", "event": "excessive broadcast traffic", "severity": "high"}, "requested_show": ["show ip traffic", "show interfaces input-errors", "show interfaces counters", "show spanning-tree", "show logging | include STORM"]}
{"instruction": "Wazuh detected event 'bgp session flap' on device ACCESS-SW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.165.26.137", "event": "bgp session flap", "severity": "high"}, "requested_show": ["show ip bgp summary", "show ip bgp neighbors", "show ip cef", "show interfaces counters errors", "show ip route"]}
{"instruction": "Wazuh detected event 'acl blocking legitimate traffic' on device BRANCH-RTR1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.212.166.242", "event": "acl blocking legitimate traffic", "severity": "high"}, "requested_show": ["show logging | include DENY", "show ip route", "show running-config | section access-list", "show ip interface", "show conn"]}
{"instruction": "Wazuh detected event 'acl blocking legitimate traffic' on device CORE-R1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.233.51.73", "event": "acl blocking legitimate traffic", "severity": "critical"}, "requested_show": ["show running-config | section access-list", "show logging | include DENY", "show conn", "show ip route", "show ip interface", "show access-lists"]}
{"instruction": "Wazuh detected event 'interface flapping' on device ACCESS-SW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.145.133.74", "event": "interface flapping", "severity": "medium"}, "requested_show": ["show spanning-tree interface", "show interfaces counters errors", "show controllers", "show interfaces status", "show logging | include LINK"]}
{"instruction": "Wazuh detected event 'blacklisted ip communication' on device ACCESS-SW2 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.222.191.155", "event": "blacklisted ip communication", "severity": "medium"}, "requested_show": ["show ip traffic", "show logging | include DENY", "show ip route", "show conn address", "show interfaces"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device BRANCH-RTR1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.53.155.236", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show interfaces counters errors", "show platform resources", "show logging | include CPU", "show memory statistics", "show processes memory sorted"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device ACCESS-SW2 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.246.81.63", "event": "high cpu usage", "severity": "low"}, "requested_show": ["show interfaces counters errors", "show memory statistics", "show processes memory sorted", "show logging | include CPU", "show platform resources"]}
{"instruction": "Wazuh detected event 'spanning tree loop detected' on device CORE-R1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.30.26.150", "event": "spanning tree loop detected", "severity": "low"}, "requested_show": ["show lldp neighbors", "show mac address-table move", "show spanning-tree detail", "show logging | include STP", "show interfaces counters errors"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device ACCESS-SW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.205.82.118", "event": "dhcp starvation attack", "severity": "critical"}, "requested_show": ["show ip traffic", "show ip dhcp conflict", "show mac address-table", "show logging | include DHCP", "show ip dhcp pool"]}
{"instruction": "Wazuh detected event 'spanning tree loop detected' on device CORE-R1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.58.115.93", "event": "spanning tree loop detected", "severity": "high"}, "requested_show": ["show spanning-tree detail", "show interfaces counters errors", "show spanning-tree", "show lldp neighbors", "show logging | include STP"]}
{"instruction": "Wazuh detected event 'bgp session flap' on device CORE-R1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.175.82.15", "event": "bgp session flap", "severity": "medium"}, "requested_show": ["show ip route", "show ip bgp neighbors", "show logging | include BGP", "show ip bgp summary", "show interfaces counters errors", "show ip cef"]}
{"instruction": "Wazuh detected event 'port scan detected' on device EDGE-FW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.118.252.220", "event": "port scan detected", "severity": "critical"}, "requested_show": ["show access-lists", "show logging | include DENY", "show ip traffic", "show ip interface brief", "show conn", "show firewall"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device CORE-R1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.161.223.65", "event": "dhcp starvation attack", "severity": "medium"}, "requested_show": ["show ip dhcp binding", "show mac address-table", "show ip dhcp pool", "show logging | include DHCP", "show ip dhcp conflict"]}
{"instruction": "Wazuh detected event 'acl blocking legitimate traffic' on device CORE-R1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.178.212.177", "event": "acl blocking legitimate traffic", "severity": "high"}, "requested_show": ["show conn", "show ip route", "show logging | include DENY", "show access-lists", "show ip interface"]}
{"instruction": "Wazuh detected event 'bgp session flap' on device ACCESS-SW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.147.244.126", "event": "bgp session flap", "severity": "medium"}, "requested_show": ["show ip bgp summary", "show ip bgp neighbors", "show ip cef", "show ip route", "show interfaces counters errors"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device EDGE-FW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.61.140.223", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show ip verify source", "show ip traffic", "show logging | include ARP", "show interfaces", "show arp"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device EDGE-FW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.185.196.162", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show ip ospf database", "show ip route ospf", "show ip ospf neighbor", "show interfaces", "show logging | include OSPF", "show ip ospf interface"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device EDGE-FW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.171.92.60", "event": "dhcp starvation attack", "severity": "critical"}, "requested_show": ["show logging | include DHCP", "show mac address-table", "show ip dhcp conflict", "show ip dhcp binding", "show ip dhcp pool", "show ip traffic"]}
{"instruction": "Wazuh detected event 'interface flapping' on device BRANCH-RTR1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.84.205.117", "event": "interface flapping", "severity": "critical"}, "requested_show": ["show interfaces", "show spanning-tree interface", "show interfaces status", "show logging | include LINK", "show interfaces counters errors", "show controllers"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device ACCESS-SW2 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.6.195.13", "event": "arp spoofing suspected", "severity": "low"}, "requested_show": ["show mac address-table", "show ip verify source", "show interfaces", "show logging | include ARP", "show ip traffic", "show arp"]}
{"instruction": "Wazuh detected event 'port scan detected' on device BRANCH-RTR1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.17.130.112", "event": "port scan detected", "severity": "critical"}, "requested_show": ["show conn", "show firewall", "show ip traffic", "show ip interface brief", "show access-lists"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device BRANCH-RTR1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.151.116.221", "event": "high cpu usage", "severity": "critical"}, "requested_show": ["show interfaces counters errors", "show logging | include CPU", "show processes memory sorted", "show memory statistics", "show platform resources"]}
{"instruction": "Wazuh detected event 'interface flapping' on device BRANCH-RTR1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.204.60.107", "event": "interface flapping", "severity": "high"}, "requested_show": ["show interfaces", "show controllers", "show spanning-tree interface", "show logging | include LINK", "show interfaces counters errors", "show interfaces status"]}
{"instruction": "Wazuh detected event 'blacklisted ip communication' on device BRANCH-RTR1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.154.250.62", "event": "blacklisted ip communication", "severity": "high"}, "requested_show": ["show ip route", "show conn address", "show access-lists", "show interfaces", "show ip traffic"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device ACCESS-SW2 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.117.199.91", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show logging | include CPU", "show processes memory sorted", "show processes cpu sorted", "show platform resources", "show memory statistics"]}
{"instruction": "Wazuh detected event 'bgp session flap' on device ACCESS-SW2 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.236.199.59", "event": "bgp session flap", "severity": "high"}, "requested_show": ["show ip bgp neighbors", "show ip cef", "show interfaces counters errors", "show logging | include BGP", "show ip bgp summary", "show ip route"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device ACCESS-SW2 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.5.231.121", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show ip ospf database", "show ip ospf neighbor", "show ip ospf interface", "show ip route ospf", "show logging | include OSPF", "show interfaces"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device BRANCH-RTR1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.59.15.231", "event": "dhcp starvation attack", "severity": "medium"}, "requested_show": ["show logging | include DHCP", "show ip dhcp conflict", "show ip dhcp binding", "show mac address-table", "show ip dhcp pool"]}
{"instruction": "Wazuh detected event 'spanning tree loop detected' on device EDGE-FW1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.255.104.90", "event": "spanning tree loop detected", "severity": "low"}, "requested_show": ["show lldp neighbors", "show logging | include STP", "show interfaces counters errors", "show mac address-table move", "show spanning-tree", "show spanning-tree detail"]}
{"instruction": "Wazuh detected event 'blacklisted ip communication' on device ACCESS-SW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.18.17.115", "event": "blacklisted ip communication", "severity": "medium"}, "requested_show": ["show interfaces", "show ip route", "show ip traffic", "show access-lists", "show logging | include DENY"]}
{"instruction": "Wazuh detected event 'interface flapping' on device ACCESS-SW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.250.32.105", "event": "interface flapping", "severity": "high"}, "requested_show": ["show logging | include LINK", "show controllers", "show spanning-tree interface", "show interfaces status", "show interfaces"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device ACCESS-SW2 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.19.139.141", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show ip verify source", "show mac address-table", "show logging | include ARP", "show ip traffic", "show arp", "show interfaces"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device CORE-R1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.136.197.49", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show interfaces", "show ip route", "show crypto ikev2 sa", "show logging | include VPN", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device ACCESS-SW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.44.153.98", "event": "dhcp starvation attack", "severity": "high"}, "requested_show": ["show ip dhcp conflict", "show ip traffic", "show logging | include DHCP", "show ip dhcp binding", "show mac address-table"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device CORE-R1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.154.174.228", "event": "dhcp starvation attack", "severity": "high"}, "requested_show": ["show ip dhcp pool", "show ip dhcp conflict", "show ip dhcp binding", "show logging | include DHCP", "show mac address-table"]}
{"instruction": "Wazuh detected event 'bgp session flap' on device ACCESS-SW1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.60.32.239", "event": "bgp session flap", "severity": "low"}, "requested_show": ["show logging | include BGP", "show ip bgp summary", "show ip cef", "show ip route", "show interfaces counters errors"]}
{"instruction": "Wazuh detected event 'interface flapping' on device ACCESS-SW2 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.66.76.30", "event": "interface flapping", "severity": "high"}, "requested_show": ["show spanning-tree interface", "show logging | include LINK", "show interfaces status", "show interfaces counters errors", "show controllers"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device BRANCH-RTR1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.209.205.114", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show processes cpu sorted", "show memory statistics", "show logging | include CPU", "show interfaces counters errors", "show platform resources", "show processes memory sorted"]}
{"instruction": "Wazuh detected event 'ssh brute-force' on device CORE-R1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.122.45.234", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show ip interface brief", "show running-config | include line vty", "show users", "show ip ssh", "show access-lists", "show logging | include SSH"]}
{"instruction": "Wazuh detected event 'port scan detected' on device ACCESS-SW2 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.26.107.27", "event": "port scan detected", "severity": "critical"}, "requested_show": ["show firewall", "show conn", "show access-lists", "show ip interface brief", "show logging | include DENY"]}
{"instruction": "Wazuh detected event 'ssh brute-force' on device BRANCH-RTR1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.43.130.202", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show running-config | include line vty", "show users", "show access-lists", "show ip interface brief", "show ip ssh", "show logging | include SSH"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device EDGE-FW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.102.62.248", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show interfaces", "show crypto session", "show ip route", "show crypto ipsec sa", "show logging | include VPN", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected event 'excessive broadcast traffic' on device CORE-R1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.215.251.105", "event": "excessive broadcast traffic", "severity": "high"}, "requested_show": ["show ip traffic", "show spanning-tree", "show logging | include STORM", "show interfaces input-errors", "show mac address-table"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device ACCESS-SW2 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.68.194.103", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show crypto ikev2 sa", "show ip route", "show crypto session", "show interfaces", "show crypto ipsec sa", "show logging | include VPN"]}
{"instruction": "Wazuh detected event 'bgp session flap' on device CORE-R1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.160.209.165", "event": "bgp session flap", "severity": "high"}, "requested_show": ["show logging | include BGP", "show interfaces counters errors", "show ip bgp summary", "show ip bgp neighbors", "show ip cef", "show ip route"]}
{"instruction": "Wazuh detected event 'bgp session flap' on device ACCESS-SW2 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.177.212.73", "event": "bgp session flap", "severity": "medium"}, "requested_show": ["show ip bgp neighbors", "show ip route", "show ip cef", "show interfaces counters errors", "show logging | include BGP", "show ip bgp summary"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device ACCESS-SW2 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.74.240.48", "event": "high cpu usage", "severity": "critical"}, "requested_show": ["show logging | include CPU", "show interfaces counters errors", "show processes memory sorted", "show platform resources", "show memory statistics"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device CORE-R1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.200.174.57", "event": "dns exfiltration suspected", "severity": "high"}, "requested_show": ["show ip traffic", "show ip dns view", "show interfaces", "show access-lists", "show conn address", "show logging | include DNS"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device CORE-R1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.124.42.145", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show logging | include VPN", "show crypto ipsec sa", "show interfaces", "show crypto ikev2 sa", "show crypto session", "show ip route"]}
{"instruction": "Wazuh detected event 'blacklisted ip communication' on device EDGE-FW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.135.34.145", "event": "blacklisted ip communication", "severity": "high"}, "requested_show": ["show logging | include DENY", "show interfaces", "show conn address", "show ip route", "show access-lists"]}
{"instruction": "Wazuh detected event 'bgp session flap' on device EDGE-FW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.192.223.252", "event": "bgp session flap", "severity": "medium"}, "requested_show": ["show logging | include BGP", "show ip route", "show interfaces counters errors", "show ip bgp neighbors", "show ip cef", "show ip bgp summary"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device EDGE-FW1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.225.69.9", "event": "high cpu usage", "severity": "low"}, "requested_show": ["show platform resources", "show processes cpu sorted", "show logging | include CPU", "show processes memory sorted", "show memory statistics"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device BRANCH-RTR1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.73.229.233", "event": "dhcp starvation attack", "severity": "high"}, "requested_show": ["show ip traffic", "show logging | include DHCP", "show ip dhcp pool", "show ip dhcp conflict", "show mac address-table", "show ip dhcp binding"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device EDGE-FW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.79.221.4", "event": "arp spoofing suspected", "severity": "critical"}, "requested_show": ["show ip verify source", "show interfaces", "show mac address-table", "show ip traffic", "show arp", "show logging | include ARP"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device BRANCH-RTR1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.235.44.161", "event": "dns exfiltration suspected", "severity": "high"}, "requested_show": ["show ip dns view", "show interfaces", "show access-lists", "show conn address", "show logging | include DNS"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device ACCESS-SW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.0.37.209", "event": "dhcp starvation attack", "severity": "high"}, "requested_show": ["show ip dhcp conflict", "show ip traffic", "show mac address-table", "show ip dhcp pool", "show logging | include DHCP", "show ip dhcp binding"]}
{"instruction": "Wazuh detected event 'blacklisted ip communication' on device BRANCH-RTR1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.86.69.66", "event": "blacklisted ip communication", "severity": "low"}, "requested_show": ["show conn address", "show access-lists", "show interfaces", "show ip traffic", "show logging | include DENY"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device BRANCH-RTR1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.11.169.172", "event": "dns exfiltration suspected", "severity": "high"}, "requested_show": ["show logging | include DNS", "show access-lists", "show interfaces", "show ip dns view", "show ip traffic"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device ACCESS-SW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.25.5.197", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show ip traffic", "show arp", "show interfaces", "show ip verify source", "show logging | include ARP", "show mac address-table"]}
{"instruction": "Wazuh detected event 'excessive broadcast traffic' on device BRANCH-RTR1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.207.226.26", "event": "excessive broadcast traffic", "severity": "medium"}, "requested_show": ["show spanning-tree", "show interfaces input-errors", "show mac address-table", "show interfaces counters", "show logging | include STORM"]}
{"instruction": "Wazuh detected event 'excessive broadcast traffic' on device EDGE-FW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.236.122.103", "event": "excessive broadcast traffic", "severity": "medium"}, "requested_show": ["show spanning-tree", "show interfaces counters", "show interfaces input-errors", "show mac address-table", "show logging | include STORM"]}
{"instruction": "Wazuh detected event 'interface flapping' on device EDGE-FW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.169.171.13", "event": "interface flapping", "severity": "medium"}, "requested_show": ["show interfaces", "show interfaces status", "show controllers", "show interfaces counters errors", "show spanning-tree interface", "show logging | include LINK"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device BRANCH-RTR1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.48.166.27", "event": "high cpu usage", "severity": "medium"}, "requested_show": ["show memory statistics", "show platform resources", "show interfaces counters errors", "show logging | include CPU", "show processes cpu sorted"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device ACCESS-SW2 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.223.175.34", "event": "arp spoofing suspected", "severity": "critical"}, "requested_show": ["show ip verify source", "show mac address-table", "show logging | include ARP", "show arp", "show ip traffic"]}
{"instruction": "Wazuh detected event 'port scan detected' on device BRANCH-RTR1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.11.85.118", "event": "port scan detected", "severity": "high"}, "requested_show": ["show ip interface brief", "show conn", "show logging | include DENY", "show ip traffic", "show firewall", "show access-lists"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device ACCESS-SW2 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.72.174.223", "event": "failed login attempts", "severity": "medium"}, "requested_show": ["show users", "show logging | include LOGIN", "show aaa servers", "show accounting", "show ip ssh"]}
{"instruction": "Wazuh detected event 'spanning tree loop detected' on device CORE-R1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.149.40.238", "event": "spanning tree loop detected", "severity": "high"}, "requested_show": ["show logging | include STP", "show lldp neighbors", "show mac address-table move", "show spanning-tree detail", "show spanning-tree", "show interfaces counters errors"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device CORE-R1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.105.100.223", "event": "failed login attempts", "severity": "critical"}, "requested_show": ["show ip ssh", "show aaa servers", "show logging | include LOGIN", "show accounting", "show running-config | include username", "show users"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device EDGE-FW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.22.9.163", "event": "failed login attempts", "severity": "high"}, "requested_show": ["show accounting", "show users", "show aaa servers", "show logging | include LOGIN", "show ip ssh"]}
{"instruction": "Wazuh detected event 'bgp session flap' on device ACCESS-SW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.75.211.72", "event": "bgp session flap", "severity": "high"}, "requested_show": ["show ip bgp summary", "show ip bgp neighbors", "show interfaces counters errors", "show ip route", "show logging | include BGP", "show ip cef"]}
{"instruction": "Wazuh detected event 'acl blocking legitimate traffic' on device BRANCH-RTR1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.83.172.100", "event": "acl blocking legitimate traffic", "severity": "critical"}, "requested_show": ["show running-config | section access-list", "show ip interface", "show logging | include DENY", "show conn", "show ip route"]}
{"instruction": "Wazuh detected event 'spanning tree loop detected' on device BRANCH-RTR1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.252.58.24", "event": "spanning tree loop detected", "severity": "high"}, "requested_show": ["show spanning-tree", "show lldp neighbors", "show logging | include STP", "show spanning-tree detail", "show interfaces counters errors", "show mac address-table move"]}
{"instruction": "Wazuh detected event 'excessive broadcast traffic' on device ACCESS-SW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.67.127.235", "event": "excessive broadcast traffic", "severity": "critical"}, "requested_show": ["show mac address-table", "show spanning-tree", "show interfaces input-errors", "show interfaces counters", "show ip traffic", "show logging | include STORM"]}
{"instruction": "Wazuh detected event 'spanning tree loop detected' on device BRANCH-RTR1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.18.3.6", "event": "spanning tree loop detected", "severity": "medium"}, "requested_show": ["show lldp neighbors", "show mac address-table move", "show interfaces counters errors", "show spanning-tree detail", "show spanning-tree"]}
{"instruction": "Wazuh detected event 'acl blocking legitimate traffic' on device BRANCH-RTR1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.86.191.99", "event": "acl blocking legitimate traffic", "severity": "high"}, "requested_show": ["show access-lists", "show ip interface", "show logging | include DENY", "show ip route", "show conn"]}
{"instruction": "Wazuh detected event 'interface flapping' on device EDGE-FW1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.201.128.10", "event": "interface flapping", "severity": "low"}, "requested_show": ["show interfaces counters errors", "show interfaces status", "show spanning-tree interface", "show logging | include LINK", "show interfaces", "show controllers"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device BRANCH-RTR1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.135.208.59", "event": "vpn tunnel down", "severity": "critical"}, "requested_show": ["show crypto session", "show logging | include VPN", "show ip route", "show crypto ipsec sa", "show crypto ikev2 sa", "show interfaces"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device BRANCH-RTR1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.98.186.200", "event": "arp spoofing suspected", "severity": "low"}, "requested_show": ["show logging | include ARP", "show mac address-table", "show interfaces", "show ip verify source", "show arp"]}
{"instruction": "Wazuh detected event 'ssh brute-force' on device ACCESS-SW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.227.178.183", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show access-lists", "show users", "show ip ssh", "show running-config | include line vty", "show ip interface brief"]}
{"instruction": "Wazuh detected event 'spanning tree loop detected' on device BRANCH-RTR1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.242.81.85", "event": "spanning tree loop detected", "severity": "high"}, "requested_show": ["show lldp neighbors", "show spanning-tree", "show logging | include STP", "show spanning-tree detail", "show interfaces counters errors", "show mac address-table move"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device BRANCH-RTR1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.60.211.29", "event": "dns exfiltration suspected", "severity": "high"}, "requested_show": ["show ip dns view", "show interfaces", "show conn address", "show logging | include DNS", "show ip traffic", "show access-lists"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device EDGE-FW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.100.160.254", "event": "dns exfiltration suspected", "severity": "medium"}, "requested_show": ["show access-lists", "show interfaces", "show ip dns view", "show conn address", "show ip traffic"]}
{"instruction": "Wazuh detected event 'bgp session flap' on device BRANCH-RTR1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.237.113.210", "event": "bgp session flap", "severity": "medium"}, "requested_show": ["show logging | include BGP", "show ip bgp summary", "show ip route", "show ip cef", "show interfaces counters errors"]}
{"instruction": "Wazuh detected event 'ssh brute-force' on device ACCESS-SW2 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.82.232.224", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show logging | include SSH", "show ip interface brief", "show running-config | include line vty", "show ip ssh", "show users", "show access-lists"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device ACCESS-SW2 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.40.240.96", "event": "dhcp starvation attack", "severity": "low"}, "requested_show": ["show mac address-table", "show ip dhcp pool", "show logging | include DHCP", "show ip dhcp binding", "show ip dhcp conflict"]}
{"instruction": "Wazuh detected event 'blacklisted ip communication' on device ACCESS-SW2 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.82.95.208", "event": "blacklisted ip communication", "severity": "medium"}, "requested_show": ["show interfaces", "show logging | include DENY", "show access-lists", "show ip route", "show ip traffic"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device EDGE-FW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.58.63.147", "event": "dhcp starvation attack", "severity": "high"}, "requested_show": ["show logging | include DHCP", "show ip dhcp conflict", "show ip dhcp binding", "show ip dhcp pool", "show ip traffic"]}
{"instruction": "Wazuh detected event 'acl blocking legitimate traffic' on device EDGE-FW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.163.62.18", "event": "acl blocking legitimate traffic", "severity": "high"}, "requested_show": ["show conn", "show running-config | section access-list", "show access-lists", "show ip route", "show logging | include DENY"]}
{"instruction": "Wazuh detected event 'bgp session flap' on device ACCESS-SW2 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.11.117.32", "event": "bgp session flap", "severity": "medium"}, "requested_show": ["show interfaces counters errors", "show ip route", "show ip bgp summary", "show logging | include BGP", "show ip bgp neighbors"]}
{"instruction": "Wazuh detected event 'bgp session flap' on device ACCESS-SW2 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.82.174.13", "event": "bgp session flap", "severity": "medium"}, "requested_show": ["show ip route", "show ip cef", "show ip bgp neighbors", "show logging | include BGP", "show ip bgp summary"]}
{"instruction": "Wazuh detected event 'excessive broadcast traffic' on device CORE-R1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.48.24.29", "event": "excessive broadcast traffic", "severity": "critical"}, "requested_show": ["show spanning-tree", "show ip traffic", "show interfaces input-errors", "show logging | include STORM", "show mac address-table"]}
{"instruction": "Wazuh detected event 'interface flapping' on device ACCESS-SW1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.20.64.141", "event": "interface flapping", "severity": "low"}, "requested_show": ["show interfaces", "show logging | include LINK", "show spanning-tree interface", "show interfaces counters errors", "show interfaces status"]}
{"instruction": "Wazuh detected event 'interface flapping' on device BRANCH-RTR1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.67.137.146", "event": "interface flapping", "severity": "critical"}, "requested_show": ["show controllers", "show interfaces status", "show logging | include LINK", "show interfaces", "show spanning-tree interface", "show interfaces counters errors"]}
{"instruction": "Wazuh detected event 'ssh brute-force' on device ACCESS-SW2 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.35.65.104", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show ip interface brief", "show access-lists", "show users", "show logging | include SSH", "show running-config | include line vty", "show ip ssh"]}
{"instruction": "Wazuh detected event 'bgp session flap' on device ACCESS-SW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.82.71.74", "event": "bgp session flap", "severity": "high"}, "requested_show": ["show ip bgp neighbors", "show interfaces counters errors", "show ip route", "show ip cef", "show logging | include BGP"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device BRANCH-RTR1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.88.33.94", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show logging | include VPN", "show crypto ikev2 sa", "show ip route", "show interfaces", "show crypto session", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected event 'spanning tree loop detected' on device ACCESS-SW2 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.184.144.251", "event": "spanning tree loop detected", "severity": "high"}, "requested_show": ["show spanning-tree", "show spanning-tree detail", "show logging | include STP", "show mac address-table move", "show interfaces counters errors"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device ACCESS-SW2 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.5.195.14", "event": "dhcp starvation attack", "severity": "high"}, "requested_show": ["show mac address-table", "show logging | include DHCP", "show ip dhcp binding", "show ip traffic", "show ip dhcp pool", "show ip dhcp conflict"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device CORE-R1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.216.250.88", "event": "dhcp starvation attack", "severity": "high"}, "requested_show": ["show ip dhcp binding", "show logging | include DHCP", "show ip dhcp conflict", "show ip dhcp pool", "show mac address-table", "show ip traffic"]}
{"instruction": "Wazuh detected event 'interface flapping' on device BRANCH-RTR1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.224.233.179", "event": "interface flapping", "severity": "medium"}, "requested_show": ["show spanning-tree interface", "show interfaces", "show interfaces status", "show logging | include LINK", "show interfaces counters errors"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device CORE-R1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.208.62.34", "event": "ospf neighbor down", "severity": "medium"}, "requested_show": ["show ip ospf neighbor", "show interfaces", "show logging | include OSPF", "show ip route ospf", "show ip ospf database", "show ip ospf interface"]}
{"instruction": "Wazuh detected event 'ssh brute-force' on device CORE-R1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.94.129.48", "event": "ssh brute-force", "severity": "low"}, "requested_show": ["show users", "show access-lists", "show logging | include SSH", "show running-config | include line vty", "show ip ssh"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device ACCESS-SW2 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.255.58.177", "event": "dns exfiltration suspected", "severity": "low"}, "requested_show": ["show ip dns view", "show conn address", "show access-lists", "show logging | include DNS", "show ip traffic"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device EDGE-FW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.215.38.166", "event": "high cpu usage", "severity": "critical"}, "requested_show": ["show processes memory sorted", "show processes cpu sorted", "show memory statistics", "show interfaces counters errors", "show platform resources", "show logging | include CPU"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device ACCESS-SW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.92.65.227", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show logging | include VPN", "show crypto session", "show ip route", "show crypto ikev2 sa", "show interfaces", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device EDGE-FW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.224.168.215", "event": "high cpu usage", "severity": "critical"}, "requested_show": ["show processes memory sorted", "show memory statistics", "show interfaces counters errors", "show processes cpu sorted", "show logging | include CPU"]}
{"instruction": "Wazuh detected event 'spanning tree loop detected' on device CORE-R1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.135.246.102", "event": "spanning tree loop detected", "severity": "medium"}, "requested_show": ["show spanning-tree detail", "show logging | include STP", "show lldp neighbors", "show spanning-tree", "show interfaces counters errors", "show mac address-table move"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device ACCESS-SW2 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.159.81.4", "event": "high cpu usage", "severity": "medium"}, "requested_show": ["show logging | include CPU", "show memory statistics", "show processes memory sorted", "show processes cpu sorted", "show platform resources"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device CORE-R1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.156.239.1", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show interfaces", "show arp", "show ip verify source", "show mac address-table", "show logging | include ARP"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device CORE-R1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.189.224.22", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show processes memory sorted", "show platform resources", "show processes cpu sorted", "show logging | include CPU", "show memory statistics", "show interfaces counters errors"]}
{"instruction": "Wazuh detected event 'ssh brute-force' on device BRANCH-RTR1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.61.209.184", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show access-lists", "show running-config | include line vty", "show users", "show logging | include SSH", "show ip interface brief", "show ip ssh"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device BRANCH-RTR1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.120.139.153", "event": "dhcp starvation attack", "severity": "low"}, "requested_show": ["show ip dhcp binding", "show ip traffic", "show ip dhcp conflict", "show logging | include DHCP", "show mac address-table", "show ip dhcp pool"]}
{"instruction": "Wazuh detected event 'excessive broadcast traffic' on device EDGE-FW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.11.56.29", "event": "excessive broadcast traffic", "severity": "high"}, "requested_show": ["show spanning-tree", "show interfaces counters", "show mac address-table", "show interfaces input-errors", "show logging | include STORM", "show ip traffic"]}
{"instruction": "Wazuh detected event 'excessive broadcast traffic' on device BRANCH-RTR1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.168.147.192", "event": "excessive broadcast traffic", "severity": "critical"}, "requested_show": ["show mac address-table", "show interfaces counters", "show interfaces input-errors", "show logging | include STORM", "show ip traffic", "show spanning-tree"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device BRANCH-RTR1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.5.0.246", "event": "arp spoofing suspected", "severity": "critical"}, "requested_show": ["show arp", "show ip traffic", "show logging | include ARP", "show ip verify source", "show interfaces"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device BRANCH-RTR1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.31.87.91", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show mac address-table", "show arp", "show ip traffic", "show logging | include ARP", "show interfaces", "show ip verify source"]}
{"instruction": "Wazuh detected event 'spanning tree loop detected' on device CORE-R1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.9.236.65", "event": "spanning tree loop detected", "severity": "critical"}, "requested_show": ["show spanning-tree", "show logging | include STP", "show spanning-tree detail", "show interfaces counters errors", "show lldp neighbors"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device BRANCH-RTR1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.91.181.211", "event": "high cpu usage", "severity": "medium"}, "requested_show": ["show logging | include CPU", "show platform resources", "show processes cpu sorted", "show memory statistics", "show interfaces counters errors"]}
{"instruction": "Wazuh detected event 'interface flapping' on device EDGE-FW1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.254.61.36", "event": "interface flapping", "severity": "low"}, "requested_show": ["show controllers", "show interfaces status", "show spanning-tree interface", "show interfaces", "show interfaces counters errors"]}
{"instruction": "Wazuh detected event 'port scan detected' on device ACCESS-SW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.145.212.214", "event": "port scan detected", "severity": "high"}, "requested_show": ["show ip interface brief", "show conn", "show access-lists", "show logging | include DENY", "show ip traffic"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device EDGE-FW1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.65.248.140", "event": "failed login attempts", "severity": "low"}, "requested_show": ["show users", "show accounting", "show running-config | include username", "show ip ssh", "show aaa servers"]}
{"instruction": "Wazuh detected event 'excessive broadcast traffic' on device EDGE-FW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.148.126.98", "event": "excessive broadcast traffic", "severity": "medium"}, "requested_show": ["show interfaces input-errors", "show ip traffic", "show spanning-tree", "show interfaces counters", "show logging | include STORM"]}
{"instruction": "Wazuh detected event 'bgp session flap' on device BRANCH-RTR1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.188.188.163", "event": "bgp session flap", "severity": "medium"}, "requested_show": ["show ip bgp summary", "show logging | include BGP", "show interfaces counters errors", "show ip bgp neighbors", "show ip cef"]}
{"instruction": "Wazuh detected event 'excessive broadcast traffic' on device ACCESS-SW2 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.150.235.61", "event": "excessive broadcast traffic", "severity": "high"}, "requested_show": ["show spanning-tree", "show interfaces input-errors", "show ip traffic", "show mac address-table", "show interfaces counters", "show logging | include STORM"]}
{"instruction": "Wazuh detected event 'port scan detected' on device ACCESS-SW2 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.192.92.106", "event": "port scan detected", "severity": "critical"}, "requested_show": ["show ip interface brief", "show firewall", "show conn", "show logging | include DENY", "show ip traffic", "show access-lists"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device EDGE-FW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.19.90.49", "event": "dns exfiltration suspected", "severity": "critical"}, "requested_show": ["show ip dns view", "show interfaces", "show access-lists", "show conn address", "show logging | include DNS"]}
{"instruction": "Wazuh detected event 'port scan detected' on device ACCESS-SW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.45.81.145", "event": "port scan detected", "severity": "medium"}, "requested_show": ["show logging | include DENY", "show firewall", "show conn", "show access-lists", "show ip traffic"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device CORE-R1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.245.159.239", "event": "high cpu usage", "severity": "medium"}, "requested_show": ["show logging | include CPU", "show processes memory sorted", "show platform resources", "show processes cpu sorted", "show interfaces counters errors", "show memory statistics"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device ACCESS-SW2 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.64.180.137", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show ip verify source", "show logging | include ARP", "show ip traffic", "show mac address-table", "show interfaces"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device EDGE-FW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.205.117.20", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show logging | include OSPF", "show ip route ospf", "show interfaces", "show ip ospf neighbor", "show ip ospf database", "show ip ospf interface"]}
{"instruction": "Wazuh detected event 'port scan detected' on device CORE-R1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.187.209.126", "event": "port scan detected", "severity": "low"}, "requested_show": ["show ip interface brief", "show ip traffic", "show firewall", "show access-lists", "show logging | include DENY", "show conn"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device EDGE-FW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.72.149.109", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show ip ospf database", "show ip ospf neighbor", "show ip route ospf", "show ip ospf interface", "show interfaces", "show logging | include OSPF"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device CORE-R1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.248.58.182", "event": "dhcp starvation attack", "severity": "critical"}, "requested_show": ["show ip dhcp pool", "show logging | include DHCP", "show ip dhcp conflict", "show ip traffic", "show mac address-table"]}
{"instruction": "Wazuh detected event 'ssh brute-force' on device ACCESS-SW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.112.178.117", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show users", "show ip ssh", "show access-lists", "show logging | include SSH", "show ip interface brief", "show running-config | include line vty"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device BRANCH-RTR1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.156.14.248", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show logging | include VPN", "show crypto ipsec sa", "show crypto ikev2 sa", "show crypto session", "show interfaces"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device BRANCH-RTR1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.174.45.79", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show crypto session", "show ip route", "show crypto ipsec sa", "show logging | include VPN", "show interfaces", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device ACCESS-SW2 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.9.66.49", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show ip route", "show interfaces", "show crypto ipsec sa", "show crypto ikev2 sa", "show crypto session"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device EDGE-FW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.21.8.152", "event": "failed login attempts", "severity": "critical"}, "requested_show": ["show accounting", "show aaa servers", "show running-config | include username", "show ip ssh", "show users", "show logging | include LOGIN"]}
{"instruction": "Wazuh detected event 'bgp session flap' on device EDGE-FW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.4.130.159", "event": "bgp session flap", "severity": "critical"}, "requested_show": ["show ip route", "show interfaces counters errors", "show logging | include BGP", "show ip bgp neighbors", "show ip bgp summary"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device ACCESS-SW2 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.200.222.199", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show platform resources", "show logging | include CPU", "show memory statistics", "show processes memory sorted", "show interfaces counters errors"]}
{"instruction": "Wazuh detected event 'acl blocking legitimate traffic' on device ACCESS-SW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.3.116.38", "event": "acl blocking legitimate traffic", "severity": "high"}, "requested_show": ["show ip interface", "show conn", "show access-lists", "show logging | include DENY", "show running-config | section access-list", "show ip route"]}
{"instruction": "Wazuh detected event 'ssh brute-force' on device ACCESS-SW2 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.137.42.172", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show logging | include SSH", "show access-lists", "show ip ssh", "show running-config | include line vty", "show ip interface brief"]}
{"instruction": "Wazuh detected event 'spanning tree loop detected' on device CORE-R1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.172.151.114", "event": "spanning tree loop detected", "severity": "low"}, "requested_show": ["show spanning-tree detail", "show lldp neighbors", "show interfaces counters errors", "show mac address-table move", "show spanning-tree"]}
{"instruction": "Wazuh detected event 'interface flapping' on device CORE-R1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.213.67.67", "event": "interface flapping", "severity": "low"}, "requested_show": ["show interfaces", "show interfaces status", "show controllers", "show spanning-tree interface", "show interfaces counters errors"]}
{"instruction": "Wazuh detected event 'bgp session flap' on device ACCESS-SW2 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.249.129.25", "event": "bgp session flap", "severity": "medium"}, "requested_show": ["show ip bgp neighbors", "show logging | include BGP", "show ip bgp summary", "show interfaces counters errors", "show ip cef"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device BRANCH-RTR1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.112.225.88", "event": "dhcp starvation attack", "severity": "medium"}, "requested_show": ["show ip dhcp binding", "show ip traffic", "show ip dhcp pool", "show mac address-table", "show logging | include DHCP", "show ip dhcp conflict"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device ACCESS-SW2 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.89.98.209", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show processes cpu sorted", "show logging | include CPU", "show platform resources", "show interfaces counters errors", "show processes memory sorted", "show memory statistics"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device ACCESS-SW2 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.77.5.130", "event": "high cpu usage", "severity": "critical"}, "requested_show": ["show processes cpu sorted", "show platform resources", "show processes memory sorted", "show memory statistics", "show logging | include CPU", "show interfaces counters errors"]}
{"instruction": "Wazuh detected event 'spanning tree loop detected' on device EDGE-FW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.60.85.182", "event": "spanning tree loop detected", "severity": "medium"}, "requested_show": ["show spanning-tree detail", "show spanning-tree", "show logging | include STP", "show mac address-table move", "show interfaces counters errors", "show lldp neighbors"]}
{"instruction": "Wazuh detected event 'acl blocking legitimate traffic' on device EDGE-FW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.55.247.68", "event": "acl blocking legitimate traffic", "severity": "critical"}, "requested_show": ["show ip interface", "show logging | include DENY", "show conn", "show access-lists", "show ip route"]}
{"instruction": "Wazuh detected event 'acl blocking legitimate traffic' on device CORE-R1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.223.124.32", "event": "acl blocking legitimate traffic", "severity": "high"}, "requested_show": ["show logging | include DENY", "show access-lists", "show conn", "show ip interface", "show running-config | section access-list"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device ACCESS-SW2 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.84.164.21", "event": "dns exfiltration suspected", "severity": "high"}, "requested_show": ["show access-lists", "show ip traffic", "show conn address", "show logging | include DNS", "show ip dns view", "show interfaces"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device ACCESS-SW2 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.91.226.185", "event": "failed login attempts", "severity": "critical"}, "requested_show": ["show logging | include LOGIN", "show ip ssh", "show accounting", "show users", "show aaa servers", "show running-config | include username"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device EDGE-FW1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.31.96.82", "event": "dns exfiltration suspected", "severity": "low"}, "requested_show": ["show logging | include DNS", "show ip traffic", "show interfaces", "show conn address", "show access-lists", "show ip dns view"]}
{"instruction": "Wazuh detected event 'ssh brute-force' on device ACCESS-SW2 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.30.8.129", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show access-lists", "show users", "show ip ssh", "show running-config | include line vty", "show ip interface brief"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device EDGE-FW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.44.132.63", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show ip ospf neighbor", "show ip route ospf", "show ip ospf database", "show ip ospf interface", "show interfaces"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device EDGE-FW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.158.73.107", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show processes memory sorted", "show logging | include CPU", "show platform resources", "show memory statistics", "show interfaces counters errors", "show processes cpu sorted"]}
{"instruction": "Wazuh detected event 'acl blocking legitimate traffic' on device ACCESS-SW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.154.233.239", "event": "acl blocking legitimate traffic", "severity": "high"}, "requested_show": ["show access-lists", "show ip route", "show running-config | section access-list", "show logging | include DENY", "show conn"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device BRANCH-RTR1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.209.27.123", "event": "dns exfiltration suspected", "severity": "high"}, "requested_show": ["show ip traffic", "show conn address", "show logging | include DNS", "show ip dns view", "show interfaces", "show access-lists"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device ACCESS-SW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.103.23.102", "event": "failed login attempts", "severity": "medium"}, "requested_show": ["show aaa servers", "show ip ssh", "show users", "show accounting", "show running-config | include username", "show logging | include LOGIN"]}
{"instruction": "Wazuh detected event 'ssh brute-force' on device CORE-R1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.83.87.183", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show running-config | include line vty", "show ip ssh", "show ip interface brief", "show logging | include SSH", "show access-lists"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device EDGE-FW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.189.104.136", "event": "dns exfiltration suspected", "severity": "high"}, "requested_show": ["show logging | include DNS", "show access-lists", "show ip traffic", "show ip dns view", "show interfaces", "show conn address"]}
{"instruction": "Wazuh detected event 'ssh brute-force' on device CORE-R1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.103.112.225", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show ip ssh", "show access-lists", "show logging | include SSH", "show running-config | include line vty", "show ip interface brief", "show users"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device ACCESS-SW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.78.100.203", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show logging | include VPN", "show crypto session", "show crypto ipsec sa", "show ip route", "show interfaces", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected event 'bgp session flap' on device EDGE-FW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.38.2.246", "event": "bgp session flap", "severity": "critical"}, "requested_show": ["show ip cef", "show ip bgp neighbors", "show interfaces counters errors", "show ip bgp summary", "show ip route"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device BRANCH-RTR1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.57.142.124", "event": "arp spoofing suspected", "severity": "low"}, "requested_show": ["show ip verify source", "show arp", "show mac address-table", "show ip traffic", "show interfaces", "show logging | include ARP"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device ACCESS-SW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.156.77.191", "event": "dns exfiltration suspected", "severity": "high"}, "requested_show": ["show ip dns view", "show interfaces", "show access-lists", "show ip traffic", "show conn address", "show logging | include DNS"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device ACCESS-SW2 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.137.124.184", "event": "failed login attempts", "severity": "medium"}, "requested_show": ["show logging | include LOGIN", "show running-config | include username", "show accounting", "show aaa servers", "show ip ssh"]}
{"instruction": "Wazuh detected event 'port scan detected' on device ACCESS-SW2 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.200.69.9", "event": "port scan detected", "severity": "medium"}, "requested_show": ["show conn", "show ip traffic", "show logging | include DENY", "show ip interface brief", "show access-lists", "show firewall"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device ACCESS-SW2 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.45.86.74", "event": "failed login attempts", "severity": "low"}, "requested_show": ["show accounting", "show ip ssh", "show running-config | include username", "show logging | include LOGIN", "show aaa servers", "show users"]}
{"instruction": "Wazuh detected event 'acl blocking legitimate traffic' on device EDGE-FW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.227.30.235", "event": "acl blocking legitimate traffic", "severity": "critical"}, "requested_show": ["show conn", "show running-config | section access-list", "show ip route", "show access-lists", "show ip interface"]}
{"instruction": "Wazuh detected event 'bgp session flap' on device CORE-R1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.181.54.11", "event": "bgp session flap", "severity": "low"}, "requested_show": ["show ip bgp summary", "show ip cef", "show interfaces counters errors", "show ip bgp neighbors", "show logging | include BGP"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device ACCESS-SW1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.159.37.178", "event": "dhcp starvation attack", "severity": "low"}, "requested_show": ["show ip traffic", "show mac address-table", "show ip dhcp pool", "show ip dhcp binding", "show ip dhcp conflict", "show logging | include DHCP"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device EDGE-FW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.230.156.131", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show processes cpu sorted", "show processes memory sorted", "show interfaces counters errors", "show platform resources", "show logging | include CPU", "show memory statistics"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device ACCESS-SW2 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.26.20.24", "event": "dhcp starvation attack", "severity": "medium"}, "requested_show": ["show ip dhcp pool", "show logging | include DHCP", "show ip dhcp binding", "show ip traffic", "show mac address-table", "show ip dhcp conflict"]}
{"instruction": "Wazuh detected event 'excessive broadcast traffic' on device ACCESS-SW2 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.228.142.173", "event": "excessive broadcast traffic", "severity": "medium"}, "requested_show": ["show mac address-table", "show interfaces input-errors", "show interfaces counters", "show ip traffic", "show logging | include STORM", "show spanning-tree"]}
{"instruction": "Wazuh detected event 'blacklisted ip communication' on device CORE-R1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.67.207.254", "event": "blacklisted ip communication", "severity": "low"}, "requested_show": ["show ip route", "show logging | include DENY", "show conn address", "show ip traffic", "show access-lists"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device BRANCH-RTR1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.183.106.168", "event": "dns exfiltration suspected", "severity": "low"}, "requested_show": ["show conn address", "show ip traffic", "show ip dns view", "show interfaces", "show logging | include DNS"]}
{"instruction": "Wazuh detected event 'port scan detected' on device ACCESS-SW2 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.221.71.238", "event": "port scan detected", "severity": "medium"}, "requested_show": ["show conn", "show ip interface brief", "show ip traffic", "show access-lists", "show firewall", "show logging | include DENY"]}
{"instruction": "Wazuh detected event 'bgp session flap' on device EDGE-FW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.57.35.28", "event": "bgp session flap", "severity": "medium"}, "requested_show": ["show interfaces counters errors", "show ip cef", "show ip route", "show ip bgp neighbors", "show ip bgp summary"]}
{"instruction": "Wazuh detected event 'port scan detected' on device ACCESS-SW2 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.201.105.181", "event": "port scan detected", "severity": "low"}, "requested_show": ["show logging | include DENY", "show firewall", "show ip interface brief", "show access-lists", "show conn", "show ip traffic"]}
{"instruction": "Wazuh detected event 'excessive broadcast traffic' on device ACCESS-SW2 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.245.228.25", "event": "excessive broadcast traffic", "severity": "high"}, "requested_show": ["show interfaces counters", "show mac address-table", "show ip traffic", "show spanning-tree", "show logging | include STORM", "show interfaces input-errors"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device BRANCH-RTR1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.247.115.77", "event": "dns exfiltration suspected", "severity": "medium"}, "requested_show": ["show logging | include DNS", "show ip traffic", "show ip dns view", "show access-lists", "show conn address", "show interfaces"]}
{"instruction": "Wazuh detected event 'blacklisted ip communication' on device CORE-R1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.46.102.197", "event": "blacklisted ip communication", "severity": "critical"}, "requested_show": ["show interfaces", "show ip route", "show access-lists", "show conn address", "show ip traffic", "show logging | include DENY"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device ACCESS-SW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.17.33.187", "event": "dns exfiltration suspected", "severity": "critical"}, "requested_show": ["show access-lists", "show logging | include DNS", "show ip traffic", "show ip dns view", "show interfaces"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device BRANCH-RTR1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.70.133.80", "event": "high cpu usage", "severity": "medium"}, "requested_show": ["show platform resources", "show processes cpu sorted", "show logging | include CPU", "show memory statistics", "show interfaces counters errors", "show processes memory sorted"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device ACCESS-SW1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.234.117.204", "event": "failed login attempts", "severity": "low"}, "requested_show": ["show running-config | include username", "show aaa servers", "show ip ssh", "show accounting", "show logging | include LOGIN"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device EDGE-FW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.206.78.192", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show arp", "show interfaces", "show logging | include ARP", "show ip verify source", "show mac address-table", "show ip traffic"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device BRANCH-RTR1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.163.140.5", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show ip route ospf", "show ip ospf database", "show ip ospf neighbor", "show ip ospf interface", "show interfaces"]}
{"instruction": "Wazuh detected event 'ssh brute-force' on device ACCESS-SW2 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.78.156.38", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show users", "show ip interface brief", "show access-lists", "show logging | include SSH", "show running-config | include line vty"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device EDGE-FW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.46.221.110", "event": "failed login attempts", "severity": "medium"}, "requested_show": ["show users", "show aaa servers", "show accounting", "show logging | include LOGIN", "show running-config | include username", "show ip ssh"]}
{"instruction": "Wazuh detected event 'interface flapping' on device EDGE-FW1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.110.24.182", "event": "interface flapping", "severity": "low"}, "requested_show": ["show interfaces counters errors", "show interfaces", "show spanning-tree interface", "show controllers", "show interfaces status"]}
{"instruction": "Wazuh detected event 'blacklisted ip communication' on device EDGE-FW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.223.81.180", "event": "blacklisted ip communication", "severity": "medium"}, "requested_show": ["show ip route", "show access-lists", "show interfaces", "show logging | include DENY", "show ip traffic", "show conn address"]}
{"instruction": "Wazuh detected event 'ssh brute-force' on device BRANCH-RTR1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.97.25.140", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show users", "show ip ssh", "show access-lists", "show logging | include SSH", "show running-config | include line vty"]}
{"instruction": "Wazuh detected event 'blacklisted ip communication' on device BRANCH-RTR1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.155.197.42", "event": "blacklisted ip communication", "severity": "medium"}, "requested_show": ["show access-lists", "show ip traffic", "show conn address", "show logging | include DENY", "show interfaces", "show ip route"]}
{"instruction": "Wazuh detected event 'interface flapping' on device EDGE-FW1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.41.235.76", "event": "interface flapping", "severity": "low"}, "requested_show": ["show logging | include LINK", "show interfaces counters errors", "show interfaces status", "show interfaces", "show controllers", "show spanning-tree interface"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device BRANCH-RTR1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.254.122.11", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show interfaces", "show crypto session", "show crypto ikev2 sa", "show logging | include VPN", "show ip route"]}
{"instruction": "Wazuh detected event 'spanning tree loop detected' on device BRANCH-RTR1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.41.152.41", "event": "spanning tree loop detected", "severity": "high"}, "requested_show": ["show lldp neighbors", "show mac address-table move", "show spanning-tree detail", "show interfaces counters errors", "show spanning-tree", "show logging | include STP"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device BRANCH-RTR1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.218.243.191", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show ip ospf interface", "show ip ospf database", "show interfaces", "show ip ospf neighbor", "show logging | include OSPF", "show ip route ospf"]}
{"instruction": "Wazuh detected event 'port scan detected' on device BRANCH-RTR1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.206.80.226", "event": "port scan detected", "severity": "high"}, "requested_show": ["show access-lists", "show ip traffic", "show ip interface brief", "show logging | include DENY", "show firewall"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device BRANCH-RTR1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.189.52.169", "event": "dhcp starvation attack", "severity": "high"}, "requested_show": ["show logging | include DHCP", "show mac address-table", "show ip dhcp binding", "show ip dhcp pool", "show ip traffic", "show ip dhcp conflict"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device BRANCH-RTR1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.3.164.125", "event": "dhcp starvation attack", "severity": "high"}, "requested_show": ["show ip dhcp binding", "show ip traffic", "show ip dhcp conflict", "show logging | include DHCP", "show ip dhcp pool", "show mac address-table"]}
{"instruction": "Wazuh detected event 'blacklisted ip communication' on device CORE-R1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.51.30.219", "event": "blacklisted ip communication", "severity": "high"}, "requested_show": ["show logging | include DENY", "show conn address", "show access-lists", "show interfaces", "show ip traffic"]}
{"instruction": "Wazuh detected event 'port scan detected' on device ACCESS-SW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.170.51.252", "event": "port scan detected", "severity": "critical"}, "requested_show": ["show ip traffic", "show ip interface brief", "show logging | include DENY", "show conn", "show access-lists"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device ACCESS-SW2 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.186.93.114", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show crypto ipsec sa", "show crypto ikev2 sa", "show ip route", "show logging | include VPN", "show interfaces", "show crypto session"]}
{"instruction": "Wazuh detected event 'ssh brute-force' on device ACCESS-SW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.57.137.75", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show ip interface brief", "show logging | include SSH", "show ip ssh", "show users", "show access-lists", "show running-config | include line vty"]}
{"instruction": "Wazuh detected event 'port scan detected' on device CORE-R1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.82.216.212", "event": "port scan detected", "severity": "low"}, "requested_show": ["show ip interface brief", "show ip traffic", "show logging | include DENY", "show firewall", "show conn", "show access-lists"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device ACCESS-SW2 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.54.235.126", "event": "arp spoofing suspected", "severity": "critical"}, "requested_show": ["show ip verify source", "show mac address-table", "show logging | include ARP", "show interfaces", "show arp", "show ip traffic"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device ACCESS-SW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.187.94.226", "event": "ospf neighbor down", "severity": "medium"}, "requested_show": ["show ip ospf database", "show ip ospf neighbor", "show ip ospf interface", "show interfaces", "show ip route ospf", "show logging | include OSPF"]}
{"instruction": "Wazuh detected event 'interface flapping' on device ACCESS-SW2 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.44.48.221", "event": "interface flapping", "severity": "critical"}, "requested_show": ["show interfaces counters errors", "show interfaces", "show spanning-tree interface", "show interfaces status", "show controllers"]}
{"instruction": "Wazuh detected event 'blacklisted ip communication' on device BRANCH-RTR1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.54.120.39", "event": "blacklisted ip communication", "severity": "medium"}, "requested_show": ["show access-lists", "show ip traffic", "show ip route", "show conn address", "show logging | include DENY"]}
{"instruction": "Wazuh detected event 'excessive broadcast traffic' on device ACCESS-SW2 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.59.196.160", "event": "excessive broadcast traffic", "severity": "high"}, "requested_show": ["show interfaces counters", "show spanning-tree", "show ip traffic", "show logging | include STORM", "show interfaces input-errors", "show mac address-table"]}
{"instruction": "Wazuh detected event 'ssh brute-force' on device ACCESS-SW2 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.155.54.164", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show users", "show ip ssh", "show ip interface brief", "show logging | include SSH", "show running-config | include line vty", "show access-lists"]}
{"instruction": "Wazuh detected event 'excessive broadcast traffic' on device CORE-R1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.32.110.205", "event": "excessive broadcast traffic", "severity": "high"}, "requested_show": ["show logging | include STORM", "show interfaces counters", "show mac address-table", "show ip traffic", "show interfaces input-errors", "show spanning-tree"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device EDGE-FW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.215.216.222", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show ip traffic", "show mac address-table", "show logging | include ARP", "show arp", "show ip verify source"]}
{"instruction": "Wazuh detected event 'bgp session flap' on device ACCESS-SW2 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.101.242.219", "event": "bgp session flap", "severity": "low"}, "requested_show": ["show ip bgp neighbors", "show logging | include BGP", "show ip bgp summary", "show ip route", "show ip cef", "show interfaces counters errors"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device CORE-R1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.64.4.151", "event": "high cpu usage", "severity": "critical"}, "requested_show": ["show platform resources", "show processes cpu sorted", "show interfaces counters errors", "show memory statistics", "show logging | include CPU", "show processes memory sorted"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device EDGE-FW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.21.190.135", "event": "high cpu usage", "severity": "critical"}, "requested_show": ["show processes memory sorted", "show interfaces counters errors", "show processes cpu sorted", "show logging | include CPU", "show memory statistics"]}
{"instruction": "Wazuh detected event 'port scan detected' on device ACCESS-SW2 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.212.91.131", "event": "port scan detected", "severity": "high"}, "requested_show": ["show ip interface brief", "show logging | include DENY", "show conn", "show ip traffic", "show access-lists"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device BRANCH-RTR1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.95.30.119", "event": "failed login attempts", "severity": "critical"}, "requested_show": ["show running-config | include username", "show logging | include LOGIN", "show aaa servers", "show ip ssh", "show accounting"]}
{"instruction": "Wazuh detected event 'bgp session flap' on device ACCESS-SW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.191.125.38", "event": "bgp session flap", "severity": "critical"}, "requested_show": ["show ip bgp neighbors", "show ip bgp summary", "show interfaces counters errors", "show logging | include BGP", "show ip route"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device ACCESS-SW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.139.114.38", "event": "dns exfiltration suspected", "severity": "high"}, "requested_show": ["show logging | include DNS", "show conn address", "show ip dns view", "show access-lists", "show interfaces"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device BRANCH-RTR1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.34.115.78", "event": "dns exfiltration suspected", "severity": "high"}, "requested_show": ["show interfaces", "show access-lists", "show conn address", "show ip traffic", "show ip dns view", "show logging | include DNS"]}
{"instruction": "Wazuh detected event 'interface flapping' on device ACCESS-SW2 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.114.90.149", "event": "interface flapping", "severity": "high"}, "requested_show": ["show spanning-tree interface", "show interfaces status", "show interfaces", "show logging | include LINK", "show controllers", "show interfaces counters errors"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device BRANCH-RTR1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.171.199.145", "event": "failed login attempts", "severity": "low"}, "requested_show": ["show ip ssh", "show aaa servers", "show running-config | include username", "show users", "show accounting", "show logging | include LOGIN"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device CORE-R1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.211.40.53", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show crypto ipsec sa", "show crypto ikev2 sa", "show crypto session", "show ip route", "show interfaces", "show logging | include VPN"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device CORE-R1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.53.105.224", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show memory statistics", "show platform resources", "show interfaces counters errors", "show logging | include CPU", "show processes memory sorted"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device BRANCH-RTR1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.147.85.18", "event": "arp spoofing suspected", "severity": "low"}, "requested_show": ["show mac address-table", "show arp", "show ip traffic", "show ip verify source", "show logging | include ARP"]}
{"instruction": "Wazuh detected event 'bgp session flap' on device ACCESS-SW2 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.225.63.4", "event": "bgp session flap", "severity": "high"}, "requested_show": ["show logging | include BGP", "show ip cef", "show ip route", "show ip bgp summary", "show interfaces counters errors", "show ip bgp neighbors"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device EDGE-FW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.164.223.155", "event": "dns exfiltration suspected", "severity": "high"}, "requested_show": ["show conn address", "show logging | include DNS", "show access-lists", "show ip traffic", "show interfaces"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device ACCESS-SW2 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.0.203.140", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show ip traffic", "show mac address-table", "show interfaces", "show arp", "show ip verify source"]}
{"instruction": "Wazuh detected event 'excessive broadcast traffic' on device BRANCH-RTR1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.28.249.134", "event": "excessive broadcast traffic", "severity": "high"}, "requested_show": ["show interfaces counters", "show spanning-tree", "show mac address-table", "show logging | include STORM", "show interfaces input-errors"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device CORE-R1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.253.103.5", "event": "failed login attempts", "severity": "high"}, "requested_show": ["show logging | include LOGIN", "show running-config | include username", "show aaa servers", "show users", "show accounting"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device ACCESS-SW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.123.94.233", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show interfaces counters errors", "show processes cpu sorted", "show logging | include CPU", "show platform resources", "show memory statistics", "show processes memory sorted"]}
{"instruction": "Wazuh detected event 'blacklisted ip communication' on device EDGE-FW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.94.91.247", "event": "blacklisted ip communication", "severity": "high"}, "requested_show": ["show conn address", "show ip route", "show interfaces", "show ip traffic", "show access-lists", "show logging | include DENY"]}
{"instruction": "Wazuh detected event 'spanning tree loop detected' on device ACCESS-SW2 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.166.38.111", "event": "spanning tree loop detected", "severity": "low"}, "requested_show": ["show lldp neighbors", "show spanning-tree", "show spanning-tree detail", "show logging | include STP", "show mac address-table move"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device CORE-R1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.254.119.188", "event": "arp spoofing suspected", "severity": "low"}, "requested_show": ["show arp", "show ip verify source", "show ip traffic", "show logging | include ARP", "show interfaces", "show mac address-table"]}
{"instruction": "Wazuh detected event 'port scan detected' on device EDGE-FW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.184.166.58", "event": "port scan detected", "severity": "critical"}, "requested_show": ["show ip interface brief", "show firewall", "show conn", "show ip traffic", "show access-lists", "show logging | include DENY"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device ACCESS-SW2 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.166.189.129", "event": "dns exfiltration suspected", "severity": "medium"}, "requested_show": ["show ip dns view", "show conn address", "show access-lists", "show logging | include DNS", "show interfaces", "show ip traffic"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device CORE-R1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.216.76.204", "event": "dhcp starvation attack", "severity": "medium"}, "requested_show": ["show ip traffic", "show ip dhcp binding", "show ip dhcp conflict", "show logging | include DHCP", "show ip dhcp pool", "show mac address-table"]}
{"instruction": "Wazuh detected event 'ssh brute-force' on device CORE-R1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.73.80.37", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show access-lists", "show running-config | include line vty", "show ip interface brief", "show logging | include SSH", "show ip ssh"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device CORE-R1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.23.192.207", "event": "high cpu usage", "severity": "medium"}, "requested_show": ["show platform resources", "show processes cpu sorted", "show processes memory sorted", "show memory statistics", "show logging | include CPU"]}
{"instruction": "Wazuh detected event 'blacklisted ip communication' on device ACCESS-SW1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.62.240.122", "event": "blacklisted ip communication", "severity": "low"}, "requested_show": ["show interfaces", "show access-lists", "show conn address", "show ip route", "show logging | include DENY", "show ip traffic"]}
{"instruction": "Wazuh detected event 'port scan detected' on device CORE-R1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.110.94.241", "event": "port scan detected", "severity": "medium"}, "requested_show": ["show conn", "show firewall", "show ip traffic", "show ip interface brief", "show access-lists"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device ACCESS-SW1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.37.150.91", "event": "failed login attempts", "severity": "low"}, "requested_show": ["show aaa servers", "show users", "show ip ssh", "show accounting", "show logging | include LOGIN"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device ACCESS-SW2 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.213.193.175", "event": "dns exfiltration suspected", "severity": "high"}, "requested_show": ["show interfaces", "show access-lists", "show ip dns view", "show conn address", "show ip traffic"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device BRANCH-RTR1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.20.191.167", "event": "high cpu usage", "severity": "low"}, "requested_show": ["show processes cpu sorted", "show memory statistics", "show logging | include CPU", "show interfaces counters errors", "show platform resources", "show processes memory sorted"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device CORE-R1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.235.126.57", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show logging | include OSPF", "show interfaces", "show ip ospf interface", "show ip ospf database", "show ip route ospf", "show ip ospf neighbor"]}
{"instruction": "Wazuh detected event 'acl blocking legitimate traffic' on device BRANCH-RTR1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.174.79.104", "event": "acl blocking legitimate traffic", "severity": "critical"}, "requested_show": ["show running-config | section access-list", "show ip interface", "show logging | include DENY", "show conn", "show ip route"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device ACCESS-SW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.3.76.22", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show interfaces counters errors", "show memory statistics", "show processes cpu sorted", "show platform resources", "show logging | include CPU", "show processes memory sorted"]}
{"instruction": "Wazuh detected event 'ssh brute-force' on device BRANCH-RTR1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.176.224.196", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show logging | include SSH", "show ip interface brief", "show users", "show running-config | include line vty", "show ip ssh", "show access-lists"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device ACCESS-SW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.10.85.56", "event": "failed login attempts", "severity": "critical"}, "requested_show": ["show running-config | include username", "show logging | include LOGIN", "show accounting", "show users", "show ip ssh"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device EDGE-FW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.252.211.25", "event": "dns exfiltration suspected", "severity": "high"}, "requested_show": ["show ip dns view", "show access-lists", "show logging | include DNS", "show conn address", "show ip traffic"]}
{"instruction": "Wazuh detected event 'ssh brute-force' on device ACCESS-SW1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.3.92.204", "event": "ssh brute-force", "severity": "low"}, "requested_show": ["show users", "show logging | include SSH", "show ip ssh", "show access-lists", "show running-config | include line vty", "show ip interface brief"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device EDGE-FW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.248.14.79", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show ip ospf database", "show logging | include OSPF", "show ip route ospf", "show interfaces", "show ip ospf interface"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device ACCESS-SW2 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.67.11.31", "event": "dns exfiltration suspected", "severity": "medium"}, "requested_show": ["show conn address", "show access-lists", "show logging | include DNS", "show ip traffic", "show ip dns view", "show interfaces"]}
{"instruction": "Wazuh detected event 'excessive broadcast traffic' on device BRANCH-RTR1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.1.130.247", "event": "excessive broadcast traffic", "severity": "critical"}, "requested_show": ["show ip traffic", "show interfaces input-errors", "show interfaces counters", "show spanning-tree", "show logging | include STORM", "show mac address-table"]}
{"instruction": "Wazuh detected event 'ssh brute-force' on device CORE-R1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.187.92.70", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show access-lists", "show logging | include SSH", "show ip ssh", "show ip interface brief", "show running-config | include line vty", "show users"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device ACCESS-SW2 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.118.13.98", "event": "vpn tunnel down", "severity": "critical"}, "requested_show": ["show logging | include VPN", "show crypto session", "show ip route", "show interfaces", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected event 'spanning tree loop detected' on device ACCESS-SW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.218.16.154", "event": "spanning tree loop detected", "severity": "medium"}, "requested_show": ["show mac address-table move", "show interfaces counters errors", "show logging | include STP", "show spanning-tree detail", "show lldp neighbors"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device EDGE-FW1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.74.39.133", "event": "dhcp starvation attack", "severity": "low"}, "requested_show": ["show mac address-table", "show ip traffic", "show ip dhcp binding", "show ip dhcp pool", "show logging | include DHCP", "show ip dhcp conflict"]}
{"instruction": "Wazuh detected event 'port scan detected' on device EDGE-FW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.183.208.139", "event": "port scan detected", "severity": "medium"}, "requested_show": ["show conn", "show ip traffic", "show logging | include DENY", "show ip interface brief", "show access-lists", "show firewall"]}
{"instruction": "Wazuh detected event 'ssh brute-force' on device EDGE-FW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.5.0.37", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show access-lists", "show running-config | include line vty", "show ip ssh", "show ip interface brief", "show users"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device BRANCH-RTR1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.110.8.155", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show interfaces", "show crypto ipsec sa", "show crypto session", "show crypto ikev2 sa", "show ip route"]}
{"instruction": "Wazuh detected event 'ssh brute-force' on device EDGE-FW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.95.232.12", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show users", "show ip ssh", "show running-config | include line vty", "show ip interface brief", "show logging | include SSH", "show access-lists"]}
{"instruction": "Wazuh detected event 'acl blocking legitimate traffic' on device EDGE-FW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.48.195.208", "event": "acl blocking legitimate traffic", "severity": "high"}, "requested_show": ["show ip route", "show ip interface", "show access-lists", "show logging | include DENY", "show running-config | section access-list"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device CORE-R1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.179.132.99", "event": "dhcp starvation attack", "severity": "critical"}, "requested_show": ["show ip traffic", "show ip dhcp binding", "show mac address-table", "show logging | include DHCP", "show ip dhcp pool"]}
{"instruction": "Wazuh detected event 'ssh brute-force' on device ACCESS-SW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.68.93.148", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show users", "show ip interface brief", "show ip ssh", "show access-lists", "show logging | include SSH"]}
{"instruction": "Wazuh detected event 'port scan detected' on device ACCESS-SW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.188.228.107", "event": "port scan detected", "severity": "high"}, "requested_show": ["show logging | include DENY", "show conn", "show ip traffic", "show firewall", "show ip interface brief"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device CORE-R1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.92.60.86", "event": "dns exfiltration suspected", "severity": "medium"}, "requested_show": ["show interfaces", "show logging | include DNS", "show ip dns view", "show access-lists", "show ip traffic", "show conn address"]}
{"instruction": "Wazuh detected event 'acl blocking legitimate traffic' on device BRANCH-RTR1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.122.42.149", "event": "acl blocking legitimate traffic", "severity": "high"}, "requested_show": ["show ip interface", "show running-config | section access-list", "show conn", "show access-lists", "show ip route"]}
{"instruction": "Wazuh detected event 'ssh brute-force' on device EDGE-FW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.150.181.127", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show ip ssh", "show logging | include SSH", "show ip interface brief", "show running-config | include line vty", "show access-lists", "show users"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device BRANCH-RTR1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.203.189.21", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show interfaces", "show crypto ikev2 sa", "show crypto session", "show logging | include VPN", "show ip route", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device BRANCH-RTR1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.157.171.28", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show ip ospf neighbor", "show ip route ospf", "show ip ospf interface", "show interfaces", "show ip ospf database"]}
{"instruction": "Wazuh detected event 'acl blocking legitimate traffic' on device EDGE-FW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.57.35.85", "event": "acl blocking legitimate traffic", "severity": "high"}, "requested_show": ["show ip route", "show logging | include DENY", "show running-config | section access-list", "show ip interface", "show conn"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device ACCESS-SW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.45.92.71", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show interfaces", "show logging | include OSPF", "show ip ospf neighbor", "show ip ospf interface", "show ip ospf database", "show ip route ospf"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device ACCESS-SW2 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.78.215.85", "event": "high cpu usage", "severity": "low"}, "requested_show": ["show processes memory sorted", "show memory statistics", "show platform resources", "show interfaces counters errors", "show logging | include CPU", "show processes cpu sorted"]}
{"instruction": "Wazuh detected event 'acl blocking legitimate traffic' on device ACCESS-SW2 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.201.152.48", "event": "acl blocking legitimate traffic", "severity": "critical"}, "requested_show": ["show logging | include DENY", "show ip interface", "show conn", "show access-lists", "show ip route"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device EDGE-FW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.98.141.126", "event": "ospf neighbor down", "severity": "medium"}, "requested_show": ["show ip ospf interface", "show ip ospf neighbor", "show logging | include OSPF", "show ip ospf database", "show interfaces"]}
{"instruction": "Wazuh detected event 'acl blocking legitimate traffic' on device BRANCH-RTR1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.221.255.170", "event": "acl blocking legitimate traffic", "severity": "medium"}, "requested_show": ["show access-lists", "show ip route", "show running-config | section access-list", "show logging | include DENY", "show ip interface", "show conn"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device BRANCH-RTR1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.31.61.78", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show ip verify source", "show ip traffic", "show mac address-table", "show logging | include ARP", "show arp", "show interfaces"]}
{"instruction": "Wazuh detected event 'excessive broadcast traffic' on device EDGE-FW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.139.59.64", "event": "excessive broadcast traffic", "severity": "medium"}, "requested_show": ["show interfaces input-errors", "show mac address-table", "show logging | include STORM", "show spanning-tree", "show interfaces counters"]}
{"instruction": "Wazuh detected event 'excessive broadcast traffic' on device ACCESS-SW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.11.99.213", "event": "excessive broadcast traffic", "severity": "high"}, "requested_show": ["show ip traffic", "show interfaces counters", "show logging | include STORM", "show interfaces input-errors", "show mac address-table"]}
{"instruction": "Wazuh detected event 'port scan detected' on device ACCESS-SW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.40.1.42", "event": "port scan detected", "severity": "medium"}, "requested_show": ["show access-lists", "show firewall", "show ip interface brief", "show logging | include DENY", "show conn"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device CORE-R1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.255.94.114", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show logging | include CPU", "show platform resources", "show processes memory sorted", "show interfaces counters errors", "show memory statistics"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device ACCESS-SW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.166.137.38", "event": "dns exfiltration suspected", "severity": "critical"}, "requested_show": ["show conn address", "show ip traffic", "show access-lists", "show ip dns view", "show logging | include DNS"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device ACCESS-SW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.43.103.233", "event": "dhcp starvation attack", "severity": "high"}, "requested_show": ["show ip dhcp conflict", "show ip dhcp binding", "show mac address-table", "show logging | include DHCP", "show ip traffic", "show ip dhcp pool"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device BRANCH-RTR1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.189.118.129", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show interfaces", "show ip traffic", "show ip verify source", "show logging | include ARP", "show arp"]}
{"instruction": "Wazuh detected event 'bgp session flap' on device ACCESS-SW2 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.197.194.135", "event": "bgp session flap", "severity": "medium"}, "requested_show": ["show logging | include BGP", "show ip route", "show ip bgp neighbors", "show ip bgp summary", "show interfaces counters errors", "show ip cef"]}
{"instruction": "Wazuh detected event 'spanning tree loop detected' on device CORE-R1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.89.105.123", "event": "spanning tree loop detected", "severity": "low"}, "requested_show": ["show interfaces counters errors", "show spanning-tree", "show mac address-table move", "show spanning-tree detail", "show lldp neighbors"]}
{"instruction": "Wazuh detected event 'port scan detected' on device EDGE-FW1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.229.152.128", "event": "port scan detected", "severity": "low"}, "requested_show": ["show conn", "show firewall", "show ip interface brief", "show access-lists", "show ip traffic"]}
{"instruction": "Wazuh detected event 'excessive broadcast traffic' on device ACCESS-SW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.140.28.119", "event": "excessive broadcast traffic", "severity": "high"}, "requested_show": ["show interfaces counters", "show logging | include STORM", "show ip traffic", "show spanning-tree", "show interfaces input-errors", "show mac address-table"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device CORE-R1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.253.139.80", "event": "high cpu usage", "severity": "medium"}, "requested_show": ["show logging | include CPU", "show memory statistics", "show platform resources", "show processes memory sorted", "show interfaces counters errors"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device ACCESS-SW2 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.134.215.36", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show platform resources", "show interfaces counters errors", "show memory statistics", "show logging | include CPU", "show processes memory sorted", "show processes cpu sorted"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device ACCESS-SW2 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.151.188.149", "event": "failed login attempts", "severity": "medium"}, "requested_show": ["show ip ssh", "show logging | include LOGIN", "show accounting", "show aaa servers", "show users", "show running-config | include username"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device CORE-R1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.14.181.116", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show ip ospf database", "show ip ospf neighbor", "show ip route ospf", "show interfaces", "show ip ospf interface", "show logging | include OSPF"]}
{"instruction": "Wazuh detected event 'interface flapping' on device ACCESS-SW1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.74.221.6", "event": "interface flapping", "severity": "low"}, "requested_show": ["show interfaces", "show interfaces counters errors", "show spanning-tree interface", "show logging | include LINK", "show controllers", "show interfaces status"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device ACCESS-SW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.56.219.165", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show ip verify source", "show logging | include ARP", "show mac address-table", "show ip traffic", "show interfaces", "show arp"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device ACCESS-SW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.114.159.75", "event": "failed login attempts", "severity": "critical"}, "requested_show": ["show running-config | include username", "show aaa servers", "show logging | include LOGIN", "show accounting", "show ip ssh"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device CORE-R1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.43.157.162", "event": "dns exfiltration suspected", "severity": "medium"}, "requested_show": ["show access-lists", "show conn address", "show logging | include DNS", "show ip traffic", "show interfaces", "show ip dns view"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device EDGE-FW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.135.241.185", "event": "arp spoofing suspected", "severity": "critical"}, "requested_show": ["show ip verify source", "show arp", "show logging | include ARP", "show ip traffic", "show mac address-table"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device ACCESS-SW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.221.243.13", "event": "dhcp starvation attack", "severity": "high"}, "requested_show": ["show logging | include DHCP", "show ip dhcp conflict", "show ip dhcp binding", "show mac address-table", "show ip traffic"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device CORE-R1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.113.72.201", "event": "failed login attempts", "severity": "high"}, "requested_show": ["show aaa servers", "show logging | include LOGIN", "show users", "show accounting", "show running-config | include username"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device CORE-R1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.155.197.225", "event": "vpn tunnel down", "severity": "critical"}, "requested_show": ["show logging | include VPN", "show crypto session", "show crypto ipsec sa", "show crypto ikev2 sa", "show interfaces"]}
{"instruction": "Wazuh detected event 'acl blocking legitimate traffic' on device ACCESS-SW2 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.215.222.108", "event": "acl blocking legitimate traffic", "severity": "high"}, "requested_show": ["show conn", "show ip interface", "show logging | include DENY", "show running-config | section access-list", "show ip route", "show access-lists"]}
{"instruction": "Wazuh detected event 'spanning tree loop detected' on device ACCESS-SW2 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.90.26.231", "event": "spanning tree loop detected", "severity": "high"}, "requested_show": ["show spanning-tree detail", "show spanning-tree", "show interfaces counters errors", "show logging | include STP", "show mac address-table move"]}
{"instruction": "Wazuh detected event 'spanning tree loop detected' on device CORE-R1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.15.92.174", "event": "spanning tree loop detected", "severity": "high"}, "requested_show": ["show interfaces counters errors", "show spanning-tree", "show spanning-tree detail", "show lldp neighbors", "show mac address-table move"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device CORE-R1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.20.236.123", "event": "dhcp starvation attack", "severity": "critical"}, "requested_show": ["show mac address-table", "show ip dhcp binding", "show logging | include DHCP", "show ip dhcp pool", "show ip dhcp conflict"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device BRANCH-RTR1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.189.193.64", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show interfaces", "show crypto session", "show crypto ipsec sa", "show ip route", "show logging | include VPN"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device ACCESS-SW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.147.161.118", "event": "vpn tunnel down", "severity": "critical"}, "requested_show": ["show interfaces", "show crypto ikev2 sa", "show ip route", "show logging | include VPN", "show crypto ipsec sa", "show crypto session"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device ACCESS-SW2 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.53.110.157", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show arp", "show ip verify source", "show ip traffic", "show logging | include ARP", "show interfaces", "show mac address-table"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device ACCESS-SW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.234.149.16", "event": "high cpu usage", "severity": "critical"}, "requested_show": ["show platform resources", "show logging | include CPU", "show memory statistics", "show processes memory sorted", "show interfaces counters errors", "show processes cpu sorted"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device BRANCH-RTR1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.67.246.27", "event": "failed login attempts", "severity": "critical"}, "requested_show": ["show accounting", "show aaa servers", "show ip ssh", "show running-config | include username", "show users", "show logging | include LOGIN"]}
{"instruction": "Wazuh detected event 'interface flapping' on device BRANCH-RTR1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.50.249.132", "event": "interface flapping", "severity": "medium"}, "requested_show": ["show controllers", "show interfaces status", "show interfaces counters errors", "show interfaces", "show logging | include LINK", "show spanning-tree interface"]}
{"instruction": "Wazuh detected event 'port scan detected' on device BRANCH-RTR1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.180.7.123", "event": "port scan detected", "severity": "high"}, "requested_show": ["show ip traffic", "show logging | include DENY", "show access-lists", "show conn", "show firewall"]}
{"instruction": "Wazuh detected event 'ssh brute-force' on device CORE-R1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.214.194.6", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show ip interface brief", "show running-config | include line vty", "show users", "show ip ssh", "show access-lists"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device BRANCH-RTR1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.63.98.146", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show interfaces", "show mac address-table", "show arp", "show logging | include ARP", "show ip traffic"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device CORE-R1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.239.24.126", "event": "vpn tunnel down", "severity": "critical"}, "requested_show": ["show crypto ikev2 sa", "show ip route", "show crypto ipsec sa", "show logging | include VPN", "show interfaces", "show crypto session"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device ACCESS-SW1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.181.244.215", "event": "vpn tunnel down", "severity": "low"}, "requested_show": ["show crypto ikev2 sa", "show logging | include VPN", "show interfaces", "show crypto session", "show ip route"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device ACCESS-SW2 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.73.129.104", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show ip route ospf", "show logging | include OSPF", "show ip ospf neighbor", "show ip ospf interface", "show interfaces", "show ip ospf database"]}
{"instruction": "Wazuh detected event 'port scan detected' on device ACCESS-SW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.10.86.194", "event": "port scan detected", "severity": "medium"}, "requested_show": ["show conn", "show firewall", "show ip traffic", "show ip interface brief", "show logging | include DENY", "show access-lists"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device EDGE-FW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.0.31.83", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show interfaces", "show mac address-table", "show logging | include ARP", "show ip verify source", "show ip traffic", "show arp"]}
{"instruction": "Wazuh detected event 'port scan detected' on device BRANCH-RTR1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.91.173.212", "event": "port scan detected", "severity": "critical"}, "requested_show": ["show firewall", "show ip traffic", "show ip interface brief", "show conn", "show logging | include DENY", "show access-lists"]}
{"instruction": "Wazuh detected event 'bgp session flap' on device EDGE-FW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.20.125.44", "event": "bgp session flap", "severity": "high"}, "requested_show": ["show interfaces counters errors", "show ip bgp summary", "show logging | include BGP", "show ip route", "show ip bgp neighbors"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device BRANCH-RTR1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.64.2.73", "event": "failed login attempts", "severity": "medium"}, "requested_show": ["show aaa servers", "show running-config | include username", "show users", "show accounting", "show ip ssh"]}
{"instruction": "Wazuh detected event 'ssh brute-force' on device CORE-R1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.81.136.103", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show logging | include SSH", "show users", "show ip interface brief", "show access-lists", "show ip ssh", "show running-config | include line vty"]}
{"instruction": "Wazuh detected event 'blacklisted ip communication' on device ACCESS-SW2 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.187.242.96", "event": "blacklisted ip communication", "severity": "high"}, "requested_show": ["show access-lists", "show ip route", "show ip traffic", "show conn address", "show logging | include DENY", "show interfaces"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device ACCESS-SW2 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.42.250.32", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show ip route", "show interfaces", "show logging | include VPN", "show crypto ikev2 sa", "show crypto session", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected event 'acl blocking legitimate traffic' on device ACCESS-SW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.205.46.3", "event": "acl blocking legitimate traffic", "severity": "high"}, "requested_show": ["show access-lists", "show ip interface", "show running-config | section access-list", "show conn", "show ip route"]}
{"instruction": "Wazuh detected event 'ssh brute-force' on device ACCESS-SW2 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.134.252.36", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show ip interface brief", "show logging | include SSH", "show access-lists", "show ip ssh", "show running-config | include line vty"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device ACCESS-SW2 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.154.181.167", "event": "failed login attempts", "severity": "medium"}, "requested_show": ["show aaa servers", "show logging | include LOGIN", "show users", "show ip ssh", "show accounting", "show running-config | include username"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device EDGE-FW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.10.112.37", "event": "failed login attempts", "severity": "critical"}, "requested_show": ["show users", "show aaa servers", "show logging | include LOGIN", "show ip ssh", "show accounting", "show running-config | include username"]}
{"instruction": "Wazuh detected event 'interface flapping' on device ACCESS-SW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.31.52.172", "event": "interface flapping", "severity": "medium"}, "requested_show": ["show interfaces", "show logging | include LINK", "show interfaces status", "show interfaces counters errors", "show controllers"]}
{"instruction": "Wazuh detected event 'port scan detected' on device ACCESS-SW2 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.120.162.64", "event": "port scan detected", "severity": "high"}, "requested_show": ["show access-lists", "show ip traffic", "show ip interface brief", "show conn", "show firewall"]}
{"instruction": "Wazuh detected event 'ssh brute-force' on device BRANCH-RTR1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.190.220.96", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show logging | include SSH", "show users", "show ip ssh", "show running-config | include line vty", "show access-lists"]}
{"instruction": "Wazuh detected event 'blacklisted ip communication' on device CORE-R1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.31.70.33", "event": "blacklisted ip communication", "severity": "critical"}, "requested_show": ["show ip traffic", "show logging | include DENY", "show ip route", "show access-lists", "show conn address"]}
{"instruction": "Wazuh detected event 'port scan detected' on device ACCESS-SW2 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.30.41.204", "event": "port scan detected", "severity": "high"}, "requested_show": ["show ip traffic", "show ip interface brief", "show conn", "show logging | include DENY", "show firewall"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device ACCESS-SW2 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.186.191.171", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show interfaces", "show ip ospf database", "show logging | include OSPF", "show ip ospf neighbor", "show ip ospf interface", "show ip route ospf"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device BRANCH-RTR1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.5.6.97", "event": "dns exfiltration suspected", "severity": "critical"}, "requested_show": ["show logging | include DNS", "show ip traffic", "show ip dns view", "show interfaces", "show access-lists", "show conn address"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device ACCESS-SW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.112.153.238", "event": "dhcp starvation attack", "severity": "critical"}, "requested_show": ["show logging | include DHCP", "show ip traffic", "show ip dhcp conflict", "show mac address-table", "show ip dhcp binding"]}
{"instruction": "Wazuh detected event 'bgp session flap' on device ACCESS-SW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.124.141.20", "event": "bgp session flap", "severity": "critical"}, "requested_show": ["show ip bgp summary", "show ip bgp neighbors", "show logging | include BGP", "show ip route", "show interfaces counters errors", "show ip cef"]}
{"instruction": "Wazuh detected event 'blacklisted ip communication' on device CORE-R1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.13.166.30", "event": "blacklisted ip communication", "severity": "critical"}, "requested_show": ["show conn address", "show interfaces", "show ip route", "show logging | include DENY", "show access-lists", "show ip traffic"]}
{"instruction": "Wazuh detected event 'interface flapping' on device ACCESS-SW2 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.181.23.213", "event": "interface flapping", "severity": "low"}, "requested_show": ["show spanning-tree interface", "show interfaces status", "show interfaces", "show logging | include LINK", "show interfaces counters errors", "show controllers"]}
{"instruction": "Wazuh detected event 'blacklisted ip communication' on device EDGE-FW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.49.172.89", "event": "blacklisted ip communication", "severity": "critical"}, "requested_show": ["show ip traffic", "show conn address", "show access-lists", "show logging | include DENY", "show ip route", "show interfaces"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device ACCESS-SW2 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.91.147.178", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show mac address-table", "show ip verify source", "show logging | include ARP", "show ip traffic", "show arp", "show interfaces"]}
{"instruction": "Wazuh detected event 'port scan detected' on device ACCESS-SW2 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.148.199.162", "event": "port scan detected", "severity": "high"}, "requested_show": ["show ip interface brief", "show conn", "show ip traffic", "show access-lists", "show logging | include DENY", "show firewall"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device ACCESS-SW2 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.69.49.2", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show ip ospf interface", "show ip route ospf", "show interfaces", "show ip ospf database", "show ip ospf neighbor", "show logging | include OSPF"]}
{"instruction": "Wazuh detected event 'port scan detected' on device ACCESS-SW2 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.177.72.170", "event": "port scan detected", "severity": "high"}, "requested_show": ["show firewall", "show logging | include DENY", "show access-lists", "show conn", "show ip interface brief"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device ACCESS-SW2 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.65.135.246", "event": "dns exfiltration suspected", "severity": "high"}, "requested_show": ["show conn address", "show ip dns view", "show interfaces", "show ip traffic", "show logging | include DNS", "show access-lists"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device ACCESS-SW2 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.166.27.209", "event": "high cpu usage", "severity": "low"}, "requested_show": ["show memory statistics", "show processes memory sorted", "show platform resources", "show logging | include CPU", "show processes cpu sorted", "show interfaces counters errors"]}
{"instruction": "Wazuh detected event 'interface flapping' on device CORE-R1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.166.146.207", "event": "interface flapping", "severity": "critical"}, "requested_show": ["show logging | include LINK", "show spanning-tree interface", "show controllers", "show interfaces", "show interfaces status"]}
{"instruction": "Wazuh detected event 'bgp session flap' on device ACCESS-SW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.26.30.103", "event": "bgp session flap", "severity": "critical"}, "requested_show": ["show ip bgp neighbors", "show interfaces counters errors", "show logging | include BGP", "show ip bgp summary", "show ip route", "show ip cef"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device BRANCH-RTR1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.150.67.179", "event": "dns exfiltration suspected", "severity": "medium"}, "requested_show": ["show interfaces", "show ip traffic", "show access-lists", "show logging | include DNS", "show conn address", "show ip dns view"]}
{"instruction": "Wazuh detected event 'bgp session flap' on device ACCESS-SW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.107.13.70", "event": "bgp session flap", "severity": "medium"}, "requested_show": ["show logging | include BGP", "show ip bgp summary", "show ip route", "show ip cef", "show interfaces counters errors", "show ip bgp neighbors"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device CORE-R1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.2.117.144", "event": "dns exfiltration suspected", "severity": "high"}, "requested_show": ["show ip traffic", "show access-lists", "show conn address", "show logging | include DNS", "show interfaces"]}
{"instruction": "Wazuh detected event 'acl blocking legitimate traffic' on device ACCESS-SW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.220.222.128", "event": "acl blocking legitimate traffic", "severity": "critical"}, "requested_show": ["show conn", "show ip route", "show running-config | section access-list", "show logging | include DENY", "show access-lists", "show ip interface"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device ACCESS-SW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.88.215.104", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show crypto session", "show crypto ipsec sa", "show interfaces", "show logging | include VPN", "show ip route", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device ACCESS-SW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.237.80.233", "event": "dhcp starvation attack", "severity": "high"}, "requested_show": ["show ip traffic", "show ip dhcp pool", "show ip dhcp binding", "show mac address-table", "show logging | include DHCP"]}
{"instruction": "Wazuh detected event 'blacklisted ip communication' on device ACCESS-SW2 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.137.142.127", "event": "blacklisted ip communication", "severity": "critical"}, "requested_show": ["show conn address", "show ip route", "show interfaces", "show ip traffic", "show logging | include DENY"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device BRANCH-RTR1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.89.144.51", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show arp", "show mac address-table", "show interfaces", "show logging | include ARP", "show ip verify source", "show ip traffic"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device ACCESS-SW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.18.31.86", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show crypto ipsec sa", "show ip route", "show logging | include VPN", "show crypto ikev2 sa", "show interfaces", "show crypto session"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device BRANCH-RTR1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.166.27.185", "event": "dns exfiltration suspected", "severity": "high"}, "requested_show": ["show logging | include DNS", "show interfaces", "show access-lists", "show ip dns view", "show ip traffic", "show conn address"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device EDGE-FW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.92.147.19", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show crypto ipsec sa", "show ip route", "show logging | include VPN", "show interfaces", "show crypto session"]}
{"instruction": "Wazuh detected event 'acl blocking legitimate traffic' on device ACCESS-SW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.25.244.212", "event": "acl blocking legitimate traffic", "severity": "high"}, "requested_show": ["show access-lists", "show ip route", "show ip interface", "show logging | include DENY", "show conn", "show running-config | section access-list"]}
{"instruction": "Wazuh detected event 'port scan detected' on device ACCESS-SW2 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.158.31.51", "event": "port scan detected", "severity": "medium"}, "requested_show": ["show conn", "show access-lists", "show logging | include DENY", "show firewall", "show ip traffic"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device ACCESS-SW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.182.41.164", "event": "ospf neighbor down", "severity": "medium"}, "requested_show": ["show logging | include OSPF", "show ip route ospf", "show ip ospf interface", "show interfaces", "show ip ospf neighbor", "show ip ospf database"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device CORE-R1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.73.228.206", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show mac address-table", "show ip verify source", "show ip traffic", "show arp", "show interfaces", "show logging | include ARP"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device CORE-R1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.178.202.58", "event": "failed login attempts", "severity": "medium"}, "requested_show": ["show running-config | include username", "show logging | include LOGIN", "show accounting", "show aaa servers", "show users"]}
{"instruction": "Wazuh detected event 'blacklisted ip communication' on device EDGE-FW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.85.59.127", "event": "blacklisted ip communication", "severity": "medium"}, "requested_show": ["show ip route", "show access-lists", "show logging | include DENY", "show interfaces", "show ip traffic", "show conn address"]}
{"instruction": "Wazuh detected event 'interface flapping' on device ACCESS-SW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.180.172.214", "event": "interface flapping", "severity": "high"}, "requested_show": ["show interfaces status", "show controllers", "show spanning-tree interface", "show interfaces", "show logging | include LINK"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device ACCESS-SW2 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.148.116.151", "event": "dhcp starvation attack", "severity": "medium"}, "requested_show": ["show logging | include DHCP", "show ip dhcp binding", "show mac address-table", "show ip dhcp conflict", "show ip dhcp pool", "show ip traffic"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device ACCESS-SW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.227.73.107", "event": "ospf neighbor down", "severity": "medium"}, "requested_show": ["show ip ospf interface", "show ip ospf database", "show ip route ospf", "show interfaces", "show ip ospf neighbor"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device ACCESS-SW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.30.105.183", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show interfaces", "show logging | include VPN", "show crypto ipsec sa", "show crypto session", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected event 'ssh brute-force' on device ACCESS-SW2 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.40.188.95", "event": "ssh brute-force", "severity": "low"}, "requested_show": ["show logging | include SSH", "show access-lists", "show users", "show running-config | include line vty", "show ip interface brief"]}
{"instruction": "Wazuh detected event 'port scan detected' on device ACCESS-SW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.105.236.155", "event": "port scan detected", "severity": "high"}, "requested_show": ["show access-lists", "show logging | include DENY", "show ip interface brief", "show ip traffic", "show firewall", "show conn"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device CORE-R1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.214.207.47", "event": "failed login attempts", "severity": "low"}, "requested_show": ["show ip ssh", "show logging | include LOGIN", "show accounting", "show users", "show running-config | include username", "show aaa servers"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device BRANCH-RTR1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.179.206.247", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show ip ospf database", "show interfaces", "show ip route ospf", "show ip ospf interface", "show ip ospf neighbor", "show logging | include OSPF"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device EDGE-FW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.111.231.206", "event": "dhcp starvation attack", "severity": "critical"}, "requested_show": ["show ip dhcp binding", "show ip traffic", "show mac address-table", "show logging | include DHCP", "show ip dhcp conflict", "show ip dhcp pool"]}
{"instruction": "Wazuh detected event 'bgp session flap' on device ACCESS-SW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.13.68.195", "event": "bgp session flap", "severity": "medium"}, "requested_show": ["show ip cef", "show interfaces counters errors", "show ip bgp summary", "show logging | include BGP", "show ip bgp neighbors", "show ip route"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device BRANCH-RTR1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.232.32.23", "event": "failed login attempts", "severity": "high"}, "requested_show": ["show aaa servers", "show running-config | include username", "show logging | include LOGIN", "show accounting", "show ip ssh"]}
{"instruction": "Wazuh detected event 'interface flapping' on device ACCESS-SW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.47.2.75", "event": "interface flapping", "severity": "high"}, "requested_show": ["show logging | include LINK", "show spanning-tree interface", "show interfaces counters errors", "show controllers", "show interfaces"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device CORE-R1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.207.176.3", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show ip ospf interface", "show ip ospf neighbor", "show interfaces", "show ip route ospf", "show logging | include OSPF", "show ip ospf database"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device CORE-R1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.242.220.243", "event": "dns exfiltration suspected", "severity": "high"}, "requested_show": ["show conn address", "show logging | include DNS", "show interfaces", "show access-lists", "show ip traffic"]}
{"instruction": "Wazuh detected event 'spanning tree loop detected' on device CORE-R1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.167.192.187", "event": "spanning tree loop detected", "severity": "high"}, "requested_show": ["show spanning-tree", "show lldp neighbors", "show spanning-tree detail", "show mac address-table move", "show logging | include STP", "show interfaces counters errors"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device ACCESS-SW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.177.48.189", "event": "high cpu usage", "severity": "medium"}, "requested_show": ["show processes memory sorted", "show platform resources", "show logging | include CPU", "show interfaces counters errors", "show memory statistics"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device BRANCH-RTR1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.77.39.172", "event": "failed login attempts", "severity": "high"}, "requested_show": ["show users", "show aaa servers", "show accounting", "show logging | include LOGIN", "show ip ssh"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device ACCESS-SW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.145.148.9", "event": "high cpu usage", "severity": "critical"}, "requested_show": ["show memory statistics", "show logging | include CPU", "show processes memory sorted", "show processes cpu sorted", "show platform resources", "show interfaces counters errors"]}
{"instruction": "Wazuh detected event 'acl blocking legitimate traffic' on device BRANCH-RTR1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.43.255.47", "event": "acl blocking legitimate traffic", "severity": "critical"}, "requested_show": ["show logging | include DENY", "show ip interface", "show conn", "show access-lists", "show running-config | section access-list", "show ip route"]}
{"instruction": "Wazuh detected event 'acl blocking legitimate traffic' on device EDGE-FW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.53.234.232", "event": "acl blocking legitimate traffic", "severity": "high"}, "requested_show": ["show conn", "show logging | include DENY", "show ip route", "show access-lists", "show ip interface", "show running-config | section access-list"]}
{"instruction": "Wazuh detected event 'port scan detected' on device BRANCH-RTR1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.173.9.230", "event": "port scan detected", "severity": "high"}, "requested_show": ["show ip traffic", "show access-lists", "show firewall", "show conn", "show ip interface brief", "show logging | include DENY"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device ACCESS-SW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.151.104.250", "event": "failed login attempts", "severity": "high"}, "requested_show": ["show running-config | include username", "show logging | include LOGIN", "show aaa servers", "show ip ssh", "show accounting"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device ACCESS-SW2 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.16.8.233", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show interfaces", "show ip traffic", "show logging | include ARP", "show mac address-table", "show arp", "show ip verify source"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device ACCESS-SW2 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.143.60.71", "event": "high cpu usage", "severity": "critical"}, "requested_show": ["show platform resources", "show interfaces counters errors", "show processes memory sorted", "show logging | include CPU", "show memory statistics", "show processes cpu sorted"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device BRANCH-RTR1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.221.5.23", "event": "arp spoofing suspected", "severity": "critical"}, "requested_show": ["show interfaces", "show mac address-table", "show ip verify source", "show logging | include ARP", "show arp"]}
{"instruction": "Wazuh detected event 'spanning tree loop detected' on device ACCESS-SW2 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.50.91.251", "event": "spanning tree loop detected", "severity": "high"}, "requested_show": ["show lldp neighbors", "show interfaces counters errors", "show logging | include STP", "show mac address-table move", "show spanning-tree detail", "show spanning-tree"]}
{"instruction": "Wazuh detected event 'acl blocking legitimate traffic' on device ACCESS-SW1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.138.107.253", "event": "acl blocking legitimate traffic", "severity": "low"}, "requested_show": ["show logging | include DENY", "show access-lists", "show ip route", "show conn", "show ip interface", "show running-config | section access-list"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device CORE-R1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.254.102.224", "event": "dns exfiltration suspected", "severity": "high"}, "requested_show": ["show conn address", "show logging | include DNS", "show interfaces", "show ip dns view", "show ip traffic"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device CORE-R1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.184.64.161", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show platform resources", "show memory statistics", "show processes memory sorted", "show interfaces counters errors", "show processes cpu sorted", "show logging | include CPU"]}
{"instruction": "Wazuh detected event 'port scan detected' on device BRANCH-RTR1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.52.243.95", "event": "port scan detected", "severity": "low"}, "requested_show": ["show conn", "show ip interface brief", "show firewall", "show logging | include DENY", "show access-lists", "show ip traffic"]}
{"instruction": "Wazuh detected event 'ssh brute-force' on device EDGE-FW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.219.99.229", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show running-config | include line vty", "show logging | include SSH", "show ip ssh", "show ip interface brief", "show access-lists"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device ACCESS-SW2 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.125.162.218", "event": "ospf neighbor down", "severity": "medium"}, "requested_show": ["show logging | include OSPF", "show ip ospf interface", "show ip route ospf", "show ip ospf database", "show ip ospf neighbor", "show interfaces"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device EDGE-FW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.175.240.46", "event": "vpn tunnel down", "severity": "critical"}, "requested_show": ["show ip route", "show interfaces", "show logging | include VPN", "show crypto ikev2 sa", "show crypto ipsec sa", "show crypto session"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device CORE-R1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.153.138.225", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show arp", "show ip verify source", "show ip traffic", "show logging | include ARP", "show interfaces"]}
{"instruction": "Wazuh detected event 'acl blocking legitimate traffic' on device BRANCH-RTR1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.24.180.52", "event": "acl blocking legitimate traffic", "severity": "high"}, "requested_show": ["show running-config | section access-list", "show ip interface", "show logging | include DENY", "show conn", "show ip route", "show access-lists"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device CORE-R1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.223.224.203", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show ip ospf neighbor", "show ip ospf database", "show ip route ospf", "show logging | include OSPF", "show ip ospf interface", "show interfaces"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device CORE-R1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.13.87.74", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show mac address-table", "show interfaces", "show ip verify source", "show logging | include ARP", "show arp", "show ip traffic"]}
{"instruction": "Wazuh detected event 'excessive broadcast traffic' on device ACCESS-SW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.111.198.138", "event": "excessive broadcast traffic", "severity": "critical"}, "requested_show": ["show interfaces counters", "show interfaces input-errors", "show mac address-table", "show spanning-tree", "show ip traffic"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device CORE-R1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.82.222.15", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show ip route ospf", "show ip ospf interface", "show ip ospf database", "show interfaces", "show ip ospf neighbor"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device ACCESS-SW2 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.214.224.101", "event": "high cpu usage", "severity": "medium"}, "requested_show": ["show memory statistics", "show processes memory sorted", "show interfaces counters errors", "show platform resources", "show logging | include CPU"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device CORE-R1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.22.124.162", "event": "ospf neighbor down", "severity": "medium"}, "requested_show": ["show ip ospf neighbor", "show ip route ospf", "show ip ospf interface", "show ip ospf database", "show logging | include OSPF", "show interfaces"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device BRANCH-RTR1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.210.111.181", "event": "dhcp starvation attack", "severity": "high"}, "requested_show": ["show ip traffic", "show ip dhcp pool", "show logging | include DHCP", "show ip dhcp conflict", "show mac address-table", "show ip dhcp binding"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device CORE-R1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.118.140.100", "event": "failed login attempts", "severity": "medium"}, "requested_show": ["show running-config | include username", "show users", "show accounting", "show aaa servers", "show ip ssh"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device BRANCH-RTR1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.131.194.12", "event": "dhcp starvation attack", "severity": "high"}, "requested_show": ["show logging | include DHCP", "show ip traffic", "show ip dhcp conflict", "show ip dhcp binding", "show mac address-table", "show ip dhcp pool"]}
{"instruction": "Wazuh detected event 'blacklisted ip communication' on device EDGE-FW1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.79.112.216", "event": "blacklisted ip communication", "severity": "low"}, "requested_show": ["show conn address", "show access-lists", "show interfaces", "show ip traffic", "show ip route", "show logging | include DENY"]}
{"instruction": "Wazuh detected event 'ssh brute-force' on device CORE-R1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.108.154.68", "event": "ssh brute-force", "severity": "low"}, "requested_show": ["show ip interface brief", "show access-lists", "show logging | include SSH", "show users", "show ip ssh"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device ACCESS-SW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.1.103.66", "event": "high cpu usage", "severity": "medium"}, "requested_show": ["show platform resources", "show interfaces counters errors", "show memory statistics", "show logging | include CPU", "show processes memory sorted"]}
{"instruction": "Wazuh detected event 'acl blocking legitimate traffic' on device ACCESS-SW2 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.15.124.103", "event": "acl blocking legitimate traffic", "severity": "low"}, "requested_show": ["show ip route", "show logging | include DENY", "show ip interface", "show running-config | section access-list", "show conn", "show access-lists"]}
{"instruction": "Wazuh detected event 'bgp session flap' on device BRANCH-RTR1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.102.248.77", "event": "bgp session flap", "severity": "critical"}, "requested_show": ["show logging | include BGP", "show ip cef", "show ip bgp summary", "show interfaces counters errors", "show ip bgp neighbors"]}
{"instruction": "Wazuh detected event 'bgp session flap' on device CORE-R1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.0.220.67", "event": "bgp session flap", "severity": "high"}, "requested_show": ["show ip route", "show logging | include BGP", "show interfaces counters errors", "show ip bgp summary", "show ip cef"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device BRANCH-RTR1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.215.181.223", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show interfaces", "show logging | include OSPF", "show ip ospf interface", "show ip ospf database", "show ip route ospf", "show ip ospf neighbor"]}
{"instruction": "Wazuh detected event 'spanning tree loop detected' on device ACCESS-SW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.24.118.135", "event": "spanning tree loop detected", "severity": "medium"}, "requested_show": ["show mac address-table move", "show lldp neighbors", "show spanning-tree detail", "show interfaces counters errors", "show logging | include STP", "show spanning-tree"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device ACCESS-SW2 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.19.57.62", "event": "dhcp starvation attack", "severity": "high"}, "requested_show": ["show ip dhcp binding", "show ip dhcp pool", "show ip traffic", "show ip dhcp conflict", "show mac address-table"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device EDGE-FW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.191.240.92", "event": "arp spoofing suspected", "severity": "critical"}, "requested_show": ["show logging | include ARP", "show mac address-table", "show interfaces", "show ip traffic", "show arp", "show ip verify source"]}
{"instruction": "Wazuh detected event 'ssh brute-force' on device ACCESS-SW2 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.204.65.61", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show logging | include SSH", "show running-config | include line vty", "show access-lists", "show users", "show ip interface brief", "show ip ssh"]}
{"instruction": "Wazuh detected event 'port scan detected' on device ACCESS-SW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.168.34.145", "event": "port scan detected", "severity": "medium"}, "requested_show": ["show logging | include DENY", "show firewall", "show ip traffic", "show conn", "show ip interface brief"]}
{"instruction": "Wazuh detected event 'blacklisted ip communication' on device CORE-R1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.63.192.101", "event": "blacklisted ip communication", "severity": "low"}, "requested_show": ["show access-lists", "show logging | include DENY", "show ip route", "show ip traffic", "show interfaces"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device ACCESS-SW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.226.140.175", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show ip traffic", "show ip verify source", "show arp", "show interfaces", "show mac address-table"]}
{"instruction": "Wazuh detected event 'ssh brute-force' on device ACCESS-SW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.105.91.199", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show access-lists", "show users", "show running-config | include line vty", "show ip ssh", "show ip interface brief"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device ACCESS-SW2 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.37.94.217", "event": "failed login attempts", "severity": "medium"}, "requested_show": ["show users", "show running-config | include username", "show aaa servers", "show logging | include LOGIN", "show ip ssh"]}
{"instruction": "Wazuh detected event 'ssh brute-force' on device EDGE-FW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.55.67.30", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show ip ssh", "show ip interface brief", "show running-config | include line vty", "show access-lists", "show logging | include SSH"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device BRANCH-RTR1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.224.88.94", "event": "ospf neighbor down", "severity": "medium"}, "requested_show": ["show logging | include OSPF", "show ip ospf interface", "show interfaces", "show ip route ospf", "show ip ospf neighbor"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device CORE-R1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.91.85.248", "event": "dhcp starvation attack", "severity": "low"}, "requested_show": ["show mac address-table", "show logging | include DHCP", "show ip dhcp pool", "show ip traffic", "show ip dhcp conflict"]}
{"instruction": "Wazuh detected event 'acl blocking legitimate traffic' on device EDGE-FW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.219.43.154", "event": "acl blocking legitimate traffic", "severity": "high"}, "requested_show": ["show conn", "show access-lists", "show running-config | section access-list", "show ip route", "show ip interface"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device ACCESS-SW2 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.81.241.209", "event": "dhcp starvation attack", "severity": "high"}, "requested_show": ["show logging | include DHCP", "show ip dhcp conflict", "show ip dhcp binding", "show ip traffic", "show ip dhcp pool"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device ACCESS-SW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.220.89.168", "event": "dhcp starvation attack", "severity": "high"}, "requested_show": ["show ip dhcp pool", "show ip traffic", "show ip dhcp binding", "show mac address-table", "show ip dhcp conflict", "show logging | include DHCP"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device BRANCH-RTR1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.9.128.201", "event": "failed login attempts", "severity": "high"}, "requested_show": ["show accounting", "show aaa servers", "show logging | include LOGIN", "show running-config | include username", "show ip ssh", "show users"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device ACCESS-SW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.189.55.111", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show interfaces", "show logging | include ARP", "show mac address-table", "show ip traffic", "show arp", "show ip verify source"]}
{"instruction": "Wazuh detected event 'acl blocking legitimate traffic' on device CORE-R1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.16.126.177", "event": "acl blocking legitimate traffic", "severity": "critical"}, "requested_show": ["show ip route", "show running-config | section access-list", "show logging | include DENY", "show conn", "show ip interface"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device ACCESS-SW2 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.80.113.84", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show ip ospf database", "show ip ospf interface", "show ip ospf neighbor", "show logging | include OSPF", "show interfaces"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device CORE-R1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.162.69.20", "event": "high cpu usage", "severity": "medium"}, "requested_show": ["show platform resources", "show memory statistics", "show logging | include CPU", "show processes memory sorted", "show interfaces counters errors"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device CORE-R1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.75.72.168", "event": "failed login attempts", "severity": "medium"}, "requested_show": ["show accounting", "show ip ssh", "show users", "show logging | include LOGIN", "show aaa servers", "show running-config | include username"]}
{"instruction": "Wazuh detected event 'port scan detected' on device CORE-R1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.230.6.10", "event": "port scan detected", "severity": "low"}, "requested_show": ["show firewall", "show logging | include DENY", "show ip traffic", "show access-lists", "show conn"]}
{"instruction": "Wazuh detected event 'port scan detected' on device EDGE-FW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.227.141.31", "event": "port scan detected", "severity": "high"}, "requested_show": ["show logging | include DENY", "show conn", "show access-lists", "show ip interface brief", "show firewall", "show ip traffic"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device ACCESS-SW2 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.84.81.81", "event": "failed login attempts", "severity": "critical"}, "requested_show": ["show running-config | include username", "show users", "show accounting", "show ip ssh", "show logging | include LOGIN"]}
{"instruction": "Wazuh detected event 'excessive broadcast traffic' on device ACCESS-SW2 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.130.111.155", "event": "excessive broadcast traffic", "severity": "high"}, "requested_show": ["show mac address-table", "show ip traffic", "show interfaces input-errors", "show spanning-tree", "show interfaces counters", "show logging | include STORM"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device EDGE-FW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.182.121.68", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show crypto ikev2 sa", "show interfaces", "show crypto session", "show logging | include VPN", "show crypto ipsec sa", "show ip route"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device BRANCH-RTR1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.45.179.231", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show logging | include OSPF", "show ip ospf database", "show interfaces", "show ip ospf interface", "show ip ospf neighbor"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device CORE-R1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.131.6.220", "event": "dhcp starvation attack", "severity": "critical"}, "requested_show": ["show ip dhcp binding", "show logging | include DHCP", "show ip dhcp conflict", "show mac address-table", "show ip traffic"]}
{"instruction": "Wazuh detected event 'acl blocking legitimate traffic' on device CORE-R1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.47.46.118", "event": "acl blocking legitimate traffic", "severity": "critical"}, "requested_show": ["show access-lists", "show logging | include DENY", "show running-config | section access-list", "show ip interface", "show ip route"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device ACCESS-SW2 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.217.60.195", "event": "failed login attempts", "severity": "high"}, "requested_show": ["show running-config | include username", "show accounting", "show users", "show logging | include LOGIN", "show aaa servers", "show ip ssh"]}
{"instruction": "Wazuh detected event 'port scan detected' on device BRANCH-RTR1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.96.63.49", "event": "port scan detected", "severity": "low"}, "requested_show": ["show ip traffic", "show logging | include DENY", "show access-lists", "show conn", "show ip interface brief"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device EDGE-FW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.27.234.139", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show ip traffic", "show ip verify source", "show mac address-table", "show logging | include ARP", "show arp"]}
{"instruction": "Wazuh detected event 'port scan detected' on device CORE-R1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.193.167.196", "event": "port scan detected", "severity": "low"}, "requested_show": ["show logging | include DENY", "show ip interface brief", "show ip traffic", "show access-lists", "show firewall", "show conn"]}
{"instruction": "Wazuh detected event 'ssh brute-force' on device ACCESS-SW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.103.19.184", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show logging | include SSH", "show access-lists", "show running-config | include line vty", "show ip interface brief", "show ip ssh", "show users"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device CORE-R1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.5.255.200", "event": "dhcp starvation attack", "severity": "critical"}, "requested_show": ["show ip traffic", "show ip dhcp pool", "show ip dhcp conflict", "show logging | include DHCP", "show ip dhcp binding"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device ACCESS-SW2 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.211.94.26", "event": "dhcp starvation attack", "severity": "medium"}, "requested_show": ["show ip dhcp binding", "show ip dhcp conflict", "show logging | include DHCP", "show mac address-table", "show ip dhcp pool"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device BRANCH-RTR1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.168.3.93", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show platform resources", "show processes memory sorted", "show interfaces counters errors", "show logging | include CPU", "show processes cpu sorted"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device EDGE-FW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.105.9.152", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show logging | include VPN", "show crypto ipsec sa", "show ip route", "show crypto session", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected event 'acl blocking legitimate traffic' on device ACCESS-SW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.166.153.144", "event": "acl blocking legitimate traffic", "severity": "high"}, "requested_show": ["show access-lists", "show ip interface", "show conn", "show ip route", "show running-config | section access-list"]}
{"instruction": "Wazuh detected event 'ssh brute-force' on device BRANCH-RTR1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.125.238.253", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show ip ssh", "show access-lists", "show users", "show running-config | include line vty", "show logging | include SSH", "show ip interface brief"]}
{"instruction": "Wazuh detected event 'excessive broadcast traffic' on device CORE-R1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.180.159.252", "event": "excessive broadcast traffic", "severity": "medium"}, "requested_show": ["show logging | include STORM", "show interfaces counters", "show mac address-table", "show interfaces input-errors", "show ip traffic", "show spanning-tree"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device BRANCH-RTR1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.165.15.219", "event": "arp spoofing suspected", "severity": "critical"}, "requested_show": ["show ip verify source", "show mac address-table", "show logging | include ARP", "show arp", "show ip traffic", "show interfaces"]}
{"instruction": "Wazuh detected event 'interface flapping' on device ACCESS-SW2 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.150.134.53", "event": "interface flapping", "severity": "medium"}, "requested_show": ["show interfaces counters errors", "show spanning-tree interface", "show interfaces", "show logging | include LINK", "show interfaces status"]}
{"instruction": "Wazuh detected event 'excessive broadcast traffic' on device ACCESS-SW2 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.116.142.74", "event": "excessive broadcast traffic", "severity": "critical"}, "requested_show": ["show ip traffic", "show interfaces input-errors", "show logging | include STORM", "show spanning-tree", "show interfaces counters"]}
{"instruction": "Wazuh detected event 'interface flapping' on device BRANCH-RTR1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.18.47.252", "event": "interface flapping", "severity": "medium"}, "requested_show": ["show interfaces status", "show interfaces", "show logging | include LINK", "show spanning-tree interface", "show controllers", "show interfaces counters errors"]}
{"instruction": "Wazuh detected event 'ssh brute-force' on device BRANCH-RTR1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.1.55.2", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show users", "show logging | include SSH", "show ip ssh", "show ip interface brief", "show access-lists", "show running-config | include line vty"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device CORE-R1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.4.8.80", "event": "dns exfiltration suspected", "severity": "high"}, "requested_show": ["show ip dns view", "show interfaces", "show access-lists", "show conn address", "show ip traffic", "show logging | include DNS"]}
{"instruction": "Wazuh detected event 'ssh brute-force' on device ACCESS-SW2 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.59.183.25", "event": "ssh brute-force", "severity": "low"}, "requested_show": ["show logging | include SSH", "show ip interface brief", "show access-lists", "show ip ssh", "show running-config | include line vty", "show users"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device EDGE-FW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.94.11.222", "event": "failed login attempts", "severity": "high"}, "requested_show": ["show users", "show ip ssh", "show aaa servers", "show accounting", "show running-config | include username", "show logging | include LOGIN"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device EDGE-FW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.134.42.77", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show logging | include VPN", "show crypto ikev2 sa", "show crypto ipsec sa", "show crypto session", "show ip route", "show interfaces"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device BRANCH-RTR1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.241.150.215", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show logging | include CPU", "show memory statistics", "show platform resources", "show processes cpu sorted", "show interfaces counters errors", "show processes memory sorted"]}
{"instruction": "Wazuh detected event 'blacklisted ip communication' on device ACCESS-SW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.248.57.187", "event": "blacklisted ip communication", "severity": "high"}, "requested_show": ["show ip route", "show interfaces", "show access-lists", "show logging | include DENY", "show conn address"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device CORE-R1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.98.171.192", "event": "vpn tunnel down", "severity": "low"}, "requested_show": ["show interfaces", "show logging | include VPN", "show crypto session", "show crypto ipsec sa", "show ip route", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected event 'blacklisted ip communication' on device ACCESS-SW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.63.123.174", "event": "blacklisted ip communication", "severity": "medium"}, "requested_show": ["show ip traffic", "show access-lists", "show conn address", "show logging | include DENY", "show ip route"]}
{"instruction": "Wazuh detected event 'interface flapping' on device CORE-R1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.119.28.121", "event": "interface flapping", "severity": "low"}, "requested_show": ["show interfaces status", "show logging | include LINK", "show controllers", "show spanning-tree interface", "show interfaces counters errors"]}
{"instruction": "Wazuh detected event 'spanning tree loop detected' on device ACCESS-SW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.115.228.98", "event": "spanning tree loop detected", "severity": "medium"}, "requested_show": ["show interfaces counters errors", "show lldp neighbors", "show mac address-table move", "show spanning-tree", "show spanning-tree detail", "show logging | include STP"]}
{"instruction": "Wazuh detected event 'spanning tree loop detected' on device ACCESS-SW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.198.92.62", "event": "spanning tree loop detected", "severity": "critical"}, "requested_show": ["show spanning-tree detail", "show interfaces counters errors", "show logging | include STP", "show mac address-table move", "show spanning-tree"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device ACCESS-SW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.164.251.20", "event": "dhcp starvation attack", "severity": "medium"}, "requested_show": ["show ip traffic", "show logging | include DHCP", "show ip dhcp pool", "show ip dhcp conflict", "show ip dhcp binding"]}
{"instruction": "Wazuh detected event 'bgp session flap' on device ACCESS-SW2 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.219.197.40", "event": "bgp session flap", "severity": "high"}, "requested_show": ["show ip bgp summary", "show logging | include BGP", "show ip bgp neighbors", "show interfaces counters errors", "show ip cef", "show ip route"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device EDGE-FW1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.113.211.196", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show ip ospf neighbor", "show ip route ospf", "show logging | include OSPF", "show ip ospf database", "show ip ospf interface"]}
{"instruction": "Wazuh detected event 'port scan detected' on device ACCESS-SW2 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.238.105.106", "event": "port scan detected", "severity": "medium"}, "requested_show": ["show conn", "show ip interface brief", "show firewall", "show ip traffic", "show access-lists"]}
{"instruction": "Wazuh detected event 'spanning tree loop detected' on device ACCESS-SW2 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.169.78.39", "event": "spanning tree loop detected", "severity": "critical"}, "requested_show": ["show mac address-table move", "show logging | include STP", "show spanning-tree detail", "show interfaces counters errors", "show lldp neighbors", "show spanning-tree"]}
{"instruction": "Wazuh detected event 'interface flapping' on device ACCESS-SW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.185.8.229", "event": "interface flapping", "severity": "high"}, "requested_show": ["show interfaces", "show logging | include LINK", "show spanning-tree interface", "show controllers", "show interfaces status", "show interfaces counters errors"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device ACCESS-SW2 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.57.206.36", "event": "failed login attempts", "severity": "critical"}, "requested_show": ["show running-config | include username", "show ip ssh", "show logging | include LOGIN", "show users", "show accounting", "show aaa servers"]}
{"instruction": "Wazuh detected event 'excessive broadcast traffic' on device ACCESS-SW2 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.6.0.118", "event": "excessive broadcast traffic", "severity": "high"}, "requested_show": ["show interfaces input-errors", "show spanning-tree", "show interfaces counters", "show logging | include STORM", "show ip traffic"]}
{"instruction": "Wazuh detected event 'excessive broadcast traffic' on device EDGE-FW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.32.34.216", "event": "excessive broadcast traffic", "severity": "medium"}, "requested_show": ["show ip traffic", "show interfaces counters", "show logging | include STORM", "show spanning-tree", "show mac address-table"]}
{"instruction": "Wazuh detected event 'ssh brute-force' on device BRANCH-RTR1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.1.34.229", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show access-lists", "show ip interface brief", "show logging | include SSH", "show ip ssh", "show running-config | include line vty"]}
{"instruction": "Wazuh detected event 'blacklisted ip communication' on device EDGE-FW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.157.78.142", "event": "blacklisted ip communication", "severity": "medium"}, "requested_show": ["show logging | include DENY", "show interfaces", "show ip traffic", "show ip route", "show access-lists", "show conn address"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device ACCESS-SW1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.138.226.218", "event": "failed login attempts", "severity": "low"}, "requested_show": ["show aaa servers", "show users", "show ip ssh", "show running-config | include username", "show logging | include LOGIN", "show accounting"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device ACCESS-SW1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.28.40.210", "event": "dhcp starvation attack", "severity": "medium"}, "requested_show": ["show ip dhcp pool", "show ip traffic", "show ip dhcp conflict", "show ip dhcp binding", "show mac address-table", "show logging | include DHCP"]}
{"instruction": "Wazuh detected event 'bgp session flap' on device ACCESS-SW2 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.102.160.113", "event": "bgp session flap", "severity": "critical"}, "requested_show": ["show logging | include BGP", "show interfaces counters errors", "show ip cef", "show ip bgp neighbors", "show ip route", "show ip bgp summary"]}
{"instruction": "Wazuh detected event 'port scan detected' on device ACCESS-SW2 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.104.102.226", "event": "port scan detected", "severity": "critical"}, "requested_show": ["show ip interface brief", "show firewall", "show ip traffic", "show logging | include DENY", "show access-lists"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device CORE-R1 with severity 'medium'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.234.88.138", "event": "dhcp starvation attack", "severity": "medium"}, "requested_show": ["show mac address-table", "show ip traffic", "show logging | include DHCP", "show ip dhcp binding", "show ip dhcp pool", "show ip dhcp conflict"]}
{"instruction": "Wazuh detected event 'port scan detected' on device ACCESS-SW1 with severity 'low'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.209.214.108", "event": "port scan detected", "severity": "low"}, "requested_show": ["show ip interface brief", "show conn", "show ip traffic", "show firewall", "show logging | include DENY", "show access-lists"]}
{"instruction": "Wazuh detected event 'blacklisted ip communication' on device CORE-R1 with severity 'critical'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.90.41.133", "event": "blacklisted ip communication", "severity": "critical"}, "requested_show": ["show logging | include DENY", "show conn address", "show ip traffic", "show interfaces", "show access-lists"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device BRANCH-RTR1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.83.105.50", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show ip route ospf", "show interfaces", "show ip ospf interface", "show ip ospf database", "show ip ospf neighbor"]}
{"instruction": "Wazuh detected event 'interface flapping' on device ACCESS-SW2 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.162.77.243", "event": "interface flapping", "severity": "high"}, "requested_show": ["show interfaces status", "show controllers", "show spanning-tree interface", "show interfaces", "show interfaces counters errors"]}
{"instruction": "Wazuh detected event 'ssh brute-force' on device EDGE-FW1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.216.46.33", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show logging | include SSH", "show running-config | include line vty", "show ip ssh", "show users", "show access-lists", "show ip interface brief"]}
{"instruction": "Wazuh detected event 'interface flapping' on device CORE-R1 with severity 'high'. Based on this alert, provide all relevant Cisco 'show' commands needed to investigate and understand the problem. Focus on routing, interfaces, logs, neighbors and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.212.200.232", "event": "interface flapping", "severity": "high"}, "requested_show": ["show controllers", "show spanning-tree interface", "show logging | include LINK", "show interfaces counters errors", "show interfaces"]}