{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "medium", "acl": 100, "interface": "GigabitEthernet0/1", "direction": "out", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "acl": 100, "direction": "out", "misconfig_type": "protocol", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 100", "no deny udp 172.16.10.0 0.0.0.255 host 10.0.3.30 eq 22", "deny tcp 172.16.10.0 0.0.0.255 host 10.0.3.30 eq 22", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 101, "interface": "GigabitEthernet0/3", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/3", "acl": 101, "direction": "in", "deny_rate": 200, "top_source": "10.0.20.0 0.0.0.63", "top_dest": "203.0.113.50", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 101", "deny icmp 10.0.20.0 0.0.0.63 host 203.0.113.50", "exit", "interface GigabitEthernet0/3", "ip access-group 101 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "high", "acl": 101, "interface": "GigabitEthernet0/0", "direction": "out", "src": "10.0.10.0 0.0.0.63", "dst": "192.0.2.25", "service": "tcp/3389", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "acl": 101, "direction": "out", "deny_hits": 200, "existing_rules_hint": ["deny tcp 10.0.10.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 101", "permit tcp 10.0.10.0 0.0.0.63 host 192.0.2.25 eq 3389", "exit", "interface GigabitEthernet0/0", "ip access-group 101 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "critical", "acl": 100, "interface": "GigabitEthernet0/0", "direction": "out", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/0", "acl": 100, "direction": "out", "misconfig_type": "wildcard", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 100", "no deny udp 10.0.30.0 0.0.255.255 host 10.0.2.20 eq 80", "deny udp 10.0.30.0 0.0.0.255 host 10.0.2.20 eq 80", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "high", "acl": 120, "interface": "Vlan20", "direction": "in", "src": "192.168.1.0 0.0.0.63", "dst": "192.0.2.25", "service": "tcp/443", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan20", "acl": 120, "direction": "in", "deny_hits": 1200, "existing_rules_hint": ["deny tcp 192.168.1.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 120", "permit tcp 192.168.1.0 0.0.0.63 host 192.0.2.25 eq 443", "exit", "interface Vlan20", "ip access-group 120 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 101, "interface": "Vlan20", "direction": "in", "src": "172.16.10.0 0.0.255.255", "dst": "10.0.3.30", "service": "udp/80", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan20", "acl": 101, "direction": "in", "deny_hits": 200, "existing_rules_hint": ["deny udp 172.16.10.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 101", "permit udp 172.16.10.0 0.0.255.255 host 10.0.3.30 eq 80", "exit", "interface Vlan20", "ip access-group 101 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "medium", "acl": 100, "interface": "Vlan99", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan99", "acl": 100, "direction": "in", "deny_rate": 500, "top_source": "10.0.30.0 0.0.0.63", "top_dest": "10.0.2.20", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 100", "permit tcp 10.0.30.0 0.0.0.63 host 10.0.2.20 eq 80", "exit", "interface Vlan99", "ip access-group 100 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "high", "acl": 100, "interface": "Vlan30", "direction": "out", "src": "10.0.10.0 0.0.0.255", "dst": "192.0.2.25", "service": "tcp/123", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan30", "acl": 100, "direction": "out", "deny_hits": 500, "existing_rules_hint": ["deny tcp 10.0.10.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 100", "permit tcp 10.0.10.0 0.0.0.255 host 192.0.2.25 eq 123", "exit", "interface Vlan30", "ip access-group 100 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "medium", "acl": 120, "interface": "GigabitEthernet0/1", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "acl": 120, "direction": "out", "deny_rate": 500, "top_source": "10.0.30.0 0.0.0.255", "top_dest": "192.0.2.25", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 120", "deny tcp 10.0.30.0 0.0.0.255 host 192.0.2.25", "exit", "interface GigabitEthernet0/1", "ip access-group 120 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 101, "interface": "GigabitEthernet0/0", "direction": "out", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "acl": 101, "direction": "out", "deny_rate": 500, "top_source": "172.16.10.0 0.0.255.255", "top_dest": "10.0.3.30", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 101", "permit tcp 172.16.10.0 0.0.255.255 host 10.0.3.30 eq 514", "exit", "interface GigabitEthernet0/0", "ip access-group 101 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "medium", "acl": 101, "interface": "GigabitEthernet0/0", "direction": "out", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/0", "acl": 101, "direction": "out", "deny_rate": 1200, "top_source": "10.0.30.0 0.0.0.255", "top_dest": "10.0.1.10", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 101", "permit tcp 10.0.30.0 0.0.0.255 host 10.0.1.10 eq 3389", "exit", "interface GigabitEthernet0/0", "ip access-group 101 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 199, "interface": "Vlan99", "direction": "out", "src": "10.0.10.0 0.0.0.63", "dst": "10.0.3.30", "service": "udp/514", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan99", "acl": 199, "direction": "out", "deny_hits": 200, "existing_rules_hint": ["deny udp 10.0.10.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit udp 10.0.10.0 0.0.0.63 host 10.0.3.30 eq 514", "exit", "interface Vlan99", "ip access-group 199 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "critical", "acl": 199, "interface": "Vlan20", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan20", "acl": 199, "direction": "out", "misconfig_type": "direction", "symptom": "unexpected deny"}], "cli_fix": ["interface Vlan20", "no ip access-group 199 in", "no ip access-group 199 out", "ip access-group 199 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "medium", "acl": 101, "interface": "Vlan40", "direction": "in", "src": "10.0.10.0 0.0.255.255", "dst": "10.0.2.20", "service": "udp/80", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan40", "acl": 101, "direction": "in", "deny_hits": 200, "existing_rules_hint": ["deny udp 10.0.10.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 101", "permit udp 10.0.10.0 0.0.255.255 host 10.0.2.20 eq 80", "exit", "interface Vlan40", "ip access-group 101 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "medium", "acl": 150, "interface": "GigabitEthernet0/3", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/3", "acl": 150, "direction": "in", "deny_rate": 1200, "top_source": "10.0.30.0 0.0.0.63", "top_dest": "198.51.100.10", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 150", "permit tcp 10.0.30.0 0.0.0.63 host 198.51.100.10 eq 53", "exit", "interface GigabitEthernet0/3", "ip access-group 150 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 100, "interface": "GigabitEthernet0/3", "direction": "out", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/3", "acl": 100, "direction": "out", "deny_rate": 1200, "top_source": "192.168.1.0 0.0.0.15", "top_dest": "10.0.1.10", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 100", "deny tcp 192.168.1.0 0.0.0.15 host 10.0.1.10", "exit", "interface GigabitEthernet0/3", "ip access-group 100 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "high", "acl": 100, "interface": "Vlan10", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan10", "acl": 100, "direction": "out", "deny_rate": 200, "top_source": "172.16.10.0 0.0.0.15", "top_dest": "192.0.2.25", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 100", "deny udp 172.16.10.0 0.0.0.15 host 192.0.2.25", "exit", "interface Vlan10", "ip access-group 100 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "high", "acl": 101, "interface": "GigabitEthernet0/1", "direction": "out", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "acl": 101, "direction": "out", "deny_rate": 500, "top_source": "10.0.10.0 0.0.0.255", "top_dest": "10.0.1.10", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 101", "deny udp 10.0.10.0 0.0.0.255 host 10.0.1.10", "exit", "interface GigabitEthernet0/1", "ip access-group 101 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "high", "acl": 199, "interface": "Vlan30", "direction": "out", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan30", "acl": 199, "direction": "out", "deny_rate": 200, "top_source": "10.0.30.0 0.0.0.15", "top_dest": "192.0.2.25", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 199", "permit tcp 10.0.30.0 0.0.0.15 host 192.0.2.25 eq 8080", "exit", "interface Vlan30", "ip access-group 199 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "high", "acl": 120, "interface": "Vlan30", "direction": "out", "src": "192.168.1.0 0.0.0.255", "dst": "192.0.2.25", "service": "udp/514", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan30", "acl": 120, "direction": "out", "deny_hits": 1200, "existing_rules_hint": ["deny udp 192.168.1.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 120", "permit udp 192.168.1.0 0.0.0.255 host 192.0.2.25 eq 514", "exit", "interface Vlan30", "ip access-group 120 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "critical", "acl": 199, "interface": "Vlan50", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan50", "acl": 199, "direction": "out", "misconfig_type": "direction", "symptom": "policy not applied"}], "cli_fix": ["interface Vlan50", "no ip access-group 199 in", "no ip access-group 199 out", "ip access-group 199 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "high", "acl": 120, "interface": "GigabitEthernet0/1", "direction": "in", "src": "10.0.40.0 0.0.0.255", "dst": "10.0.2.20", "service": "udp/23", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "acl": 120, "direction": "in", "deny_hits": 200, "existing_rules_hint": ["deny udp 10.0.40.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 120", "permit udp 10.0.40.0 0.0.0.255 host 10.0.2.20 eq 23", "exit", "interface GigabitEthernet0/1", "ip access-group 120 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "high", "acl": 150, "interface": "Vlan99", "direction": "in", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan99", "acl": 150, "direction": "in", "misconfig_type": "direction", "symptom": "unexpected deny"}], "cli_fix": ["interface Vlan99", "no ip access-group 150 in", "no ip access-group 150 out", "ip access-group 150 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 110, "interface": "GigabitEthernet0/2", "direction": "out", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "acl": 110, "direction": "out", "deny_rate": 500, "top_source": "10.0.20.0 0.0.0.63", "top_dest": "192.0.2.25", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 110", "permit tcp 10.0.20.0 0.0.0.63 host 192.0.2.25 eq 514", "exit", "interface GigabitEthernet0/2", "ip access-group 110 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "critical", "acl": 199, "interface": "GigabitEthernet0/1", "direction": "in", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "acl": 199, "direction": "in", "misconfig_type": "direction", "symptom": "policy not applied"}], "cli_fix": ["interface GigabitEthernet0/1", "no ip access-group 199 in", "no ip access-group 199 out", "ip access-group 199 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "medium", "acl": 110, "interface": "Vlan10", "direction": "out", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan10", "acl": 110, "direction": "out", "misconfig_type": "wildcard", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 110", "no deny udp 172.16.10.0 0.0.0.255 host 203.0.113.50 eq 3389", "deny udp 172.16.10.0 0.0.0.63 host 203.0.113.50 eq 3389", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "critical", "acl": 100, "interface": "Vlan40", "direction": "in", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan40", "acl": 100, "direction": "in", "misconfig_type": "wildcard", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 100", "no deny udp 192.168.1.0 0.0.0.63 host 10.0.3.30 eq 514", "deny udp 192.168.1.0 0.0.0.15 host 10.0.3.30 eq 514", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "high", "acl": 150, "interface": "Vlan10", "direction": "out", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan10", "acl": 150, "direction": "out", "misconfig_type": "wildcard", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 150", "no deny udp 10.0.40.0 0.0.255.255 host 192.0.2.25 eq 161", "deny udp 10.0.40.0 0.0.0.63 host 192.0.2.25 eq 161", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "medium", "acl": 120, "interface": "Vlan99", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan99", "acl": 120, "direction": "out", "misconfig_type": "direction", "symptom": "unexpected permit"}], "cli_fix": ["interface Vlan99", "no ip access-group 120 in", "no ip access-group 120 out", "ip access-group 120 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "critical", "acl": 150, "interface": "GigabitEthernet0/2", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "acl": 150, "direction": "out", "misconfig_type": "direction", "symptom": "unexpected deny"}], "cli_fix": ["interface GigabitEthernet0/2", "no ip access-group 150 in", "no ip access-group 150 out", "ip access-group 150 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "high", "acl": 100, "interface": "GigabitEthernet0/1", "direction": "out", "src": "192.168.1.0 0.0.0.15", "dst": "203.0.113.50", "service": "tcp/80", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "acl": 100, "direction": "out", "deny_hits": 200, "existing_rules_hint": ["deny tcp 192.168.1.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 100", "permit tcp 192.168.1.0 0.0.0.15 host 203.0.113.50 eq 80", "exit", "interface GigabitEthernet0/1", "ip access-group 100 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "medium", "acl": 110, "interface": "Vlan40", "direction": "out", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan40", "acl": 110, "direction": "out", "deny_rate": 1200, "top_source": "10.0.10.0 0.0.255.255", "top_dest": "203.0.113.50", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 110", "deny udp 10.0.10.0 0.0.255.255 host 203.0.113.50", "exit", "interface Vlan40", "ip access-group 110 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 120, "interface": "GigabitEthernet0/3", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/3", "acl": 120, "direction": "out", "deny_rate": 200, "top_source": "10.0.10.0 0.0.255.255", "top_dest": "198.51.100.10", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 120", "permit tcp 10.0.10.0 0.0.255.255 host 198.51.100.10 eq 3389", "exit", "interface GigabitEthernet0/3", "ip access-group 120 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 100, "interface": "Vlan20", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan20", "acl": 100, "direction": "out", "deny_rate": 500, "top_source": "10.0.20.0 0.0.255.255", "top_dest": "198.51.100.10", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 100", "permit tcp 10.0.20.0 0.0.255.255 host 198.51.100.10 eq 8080", "exit", "interface Vlan20", "ip access-group 100 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "critical", "acl": 101, "interface": "GigabitEthernet0/1", "direction": "in", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "acl": 101, "direction": "in", "misconfig_type": "protocol", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 101", "no deny udp 172.16.10.0 0.0.0.63 host 198.51.100.10 eq 80", "deny tcp 172.16.10.0 0.0.0.63 host 198.51.100.10 eq 80", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 110, "interface": "GigabitEthernet0/0", "direction": "out", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/0", "acl": 110, "direction": "out", "deny_rate": 500, "top_source": "192.168.1.0 0.0.0.15", "top_dest": "10.0.3.30", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 110", "permit tcp 192.168.1.0 0.0.0.15 host 10.0.3.30 eq 443", "exit", "interface GigabitEthernet0/0", "ip access-group 110 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 120, "interface": "GigabitEthernet0/0", "direction": "in", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "acl": 120, "direction": "in", "deny_rate": 1200, "top_source": "192.168.1.0 0.0.0.255", "top_dest": "198.51.100.10", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 120", "deny udp 192.168.1.0 0.0.0.255 host 198.51.100.10", "exit", "interface GigabitEthernet0/0", "ip access-group 120 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 100, "interface": "Vlan20", "direction": "out", "src": "10.0.40.0 0.0.255.255", "dst": "198.51.100.10", "service": "tcp/22", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan20", "acl": 100, "direction": "out", "deny_hits": 1200, "existing_rules_hint": ["deny tcp 10.0.40.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 100", "permit tcp 10.0.40.0 0.0.255.255 host 198.51.100.10 eq 22", "exit", "interface Vlan20", "ip access-group 100 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 110, "interface": "Vlan10", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan10", "acl": 110, "direction": "out", "deny_rate": 5000, "top_source": "10.0.10.0 0.0.0.63", "top_dest": "10.0.3.30", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 110", "permit tcp 10.0.10.0 0.0.0.63 host 10.0.3.30 eq 161", "exit", "interface Vlan10", "ip access-group 110 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "high", "acl": 110, "interface": "GigabitEthernet0/2", "direction": "out", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "acl": 110, "direction": "out", "misconfig_type": "protocol", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 110", "no deny tcp 172.16.10.0 0.0.255.255 host 10.0.1.10 eq 123", "deny udp 172.16.10.0 0.0.255.255 host 10.0.1.10 eq 123", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "high", "acl": 199, "interface": "GigabitEthernet0/3", "direction": "in", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "acl": 199, "direction": "in", "misconfig_type": "wildcard", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 199", "no deny tcp 192.168.1.0 0.0.0.15 host 10.0.2.20 eq 123", "deny tcp 192.168.1.0 0.0.0.63 host 10.0.2.20 eq 123", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "high", "acl": 100, "interface": "GigabitEthernet0/3", "direction": "in", "src": "10.0.30.0 0.0.255.255", "dst": "10.0.1.10", "service": "udp/161", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "acl": 100, "direction": "in", "deny_hits": 500, "existing_rules_hint": ["deny udp 10.0.30.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 100", "permit udp 10.0.30.0 0.0.255.255 host 10.0.1.10 eq 161", "exit", "interface GigabitEthernet0/3", "ip access-group 100 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "medium", "acl": 101, "interface": "Vlan20", "direction": "in", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan20", "acl": 101, "direction": "in", "misconfig_type": "direction", "symptom": "unexpected permit"}], "cli_fix": ["interface Vlan20", "no ip access-group 101 in", "no ip access-group 101 out", "ip access-group 101 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "high", "acl": 101, "interface": "Vlan99", "direction": "out", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan99", "acl": 101, "direction": "out", "deny_rate": 500, "top_source": "172.16.10.0 0.0.0.63", "top_dest": "192.0.2.25", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 101", "permit tcp 172.16.10.0 0.0.0.63 host 192.0.2.25 eq 8080", "exit", "interface Vlan99", "ip access-group 101 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "high", "acl": 100, "interface": "Vlan10", "direction": "out", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan10", "acl": 100, "direction": "out", "deny_rate": 5000, "top_source": "172.16.10.0 0.0.0.255", "top_dest": "10.0.1.10", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 100", "deny udp 172.16.10.0 0.0.0.255 host 10.0.1.10", "exit", "interface Vlan10", "ip access-group 100 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "high", "acl": 110, "interface": "Vlan20", "direction": "out", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan20", "acl": 110, "direction": "out", "misconfig_type": "protocol", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 110", "no deny udp 10.0.40.0 0.0.0.15 host 203.0.113.50 eq 53", "deny tcp 10.0.40.0 0.0.0.15 host 203.0.113.50 eq 53", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "high", "acl": 101, "interface": "Vlan30", "direction": "in", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan30", "acl": 101, "direction": "in", "deny_rate": 1200, "top_source": "10.0.20.0 0.0.0.15", "top_dest": "10.0.2.20", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 101", "permit tcp 10.0.20.0 0.0.0.15 host 10.0.2.20 eq 80", "exit", "interface Vlan30", "ip access-group 101 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 101, "interface": "GigabitEthernet0/1", "direction": "out", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "acl": 101, "direction": "out", "deny_rate": 1200, "top_source": "172.16.10.0 0.0.255.255", "top_dest": "198.51.100.10", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 101", "permit tcp 172.16.10.0 0.0.255.255 host 198.51.100.10 eq 53", "exit", "interface GigabitEthernet0/1", "ip access-group 101 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "high", "acl": 101, "interface": "GigabitEthernet0/0", "direction": "out", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "acl": 101, "direction": "out", "misconfig_type": "protocol", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 101", "no deny tcp 10.0.20.0 0.0.0.15 host 192.0.2.25 eq 23", "deny udp 10.0.20.0 0.0.0.15 host 192.0.2.25 eq 23", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "high", "acl": 101, "interface": "Vlan30", "direction": "in", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan30", "acl": 101, "direction": "in", "deny_rate": 5000, "top_source": "10.0.40.0 0.0.0.63", "top_dest": "203.0.113.50", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 101", "permit tcp 10.0.40.0 0.0.0.63 host 203.0.113.50 eq 8080", "exit", "interface Vlan30", "ip access-group 101 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "medium", "acl": 100, "interface": "GigabitEthernet0/3", "direction": "in", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "acl": 100, "direction": "in", "misconfig_type": "direction", "symptom": "unexpected deny"}], "cli_fix": ["interface GigabitEthernet0/3", "no ip access-group 100 in", "no ip access-group 100 out", "ip access-group 100 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "high", "acl": 100, "interface": "Vlan50", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan50", "acl": 100, "direction": "out", "deny_rate": 5000, "top_source": "172.16.10.0 0.0.0.15", "top_dest": "10.0.2.20", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 100", "permit tcp 172.16.10.0 0.0.0.15 host 10.0.2.20 eq 80", "exit", "interface Vlan50", "ip access-group 100 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "medium", "acl": 120, "interface": "GigabitEthernet0/0", "direction": "out", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "acl": 120, "direction": "out", "misconfig_type": "protocol", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 120", "no deny tcp 10.0.40.0 0.0.0.63 host 203.0.113.50 eq 3389", "deny udp 10.0.40.0 0.0.0.63 host 203.0.113.50 eq 3389", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "high", "acl": 100, "interface": "GigabitEthernet0/0", "direction": "out", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/0", "acl": 100, "direction": "out", "misconfig_type": "wildcard", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 100", "no deny tcp 10.0.30.0 0.0.0.15 host 10.0.2.20 eq 22", "deny tcp 10.0.30.0 0.0.0.63 host 10.0.2.20 eq 22", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "medium", "acl": 120, "interface": "Vlan10", "direction": "out", "src": "10.0.20.0 0.0.0.255", "dst": "203.0.113.50", "service": "udp/123", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan10", "acl": 120, "direction": "out", "deny_hits": 500, "existing_rules_hint": ["deny udp 10.0.20.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 120", "permit udp 10.0.20.0 0.0.0.255 host 203.0.113.50 eq 123", "exit", "interface Vlan10", "ip access-group 120 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "critical", "acl": 100, "interface": "Vlan99", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan99", "acl": 100, "direction": "out", "misconfig_type": "direction", "symptom": "policy not applied"}], "cli_fix": ["interface Vlan99", "no ip access-group 100 in", "no ip access-group 100 out", "ip access-group 100 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "medium", "acl": 100, "interface": "GigabitEthernet0/1", "direction": "out", "src": "10.0.20.0 0.0.255.255", "dst": "203.0.113.50", "service": "tcp/123", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "acl": 100, "direction": "out", "deny_hits": 500, "existing_rules_hint": ["deny tcp 10.0.20.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 100", "permit tcp 10.0.20.0 0.0.255.255 host 203.0.113.50 eq 123", "exit", "interface GigabitEthernet0/1", "ip access-group 100 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 199, "interface": "Vlan50", "direction": "in", "src": "192.168.1.0 0.0.255.255", "dst": "10.0.3.30", "service": "tcp/161", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan50", "acl": 199, "direction": "in", "deny_hits": 1200, "existing_rules_hint": ["deny tcp 192.168.1.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit tcp 192.168.1.0 0.0.255.255 host 10.0.3.30 eq 161", "exit", "interface Vlan50", "ip access-group 199 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "medium", "acl": 110, "interface": "Vlan30", "direction": "out", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan30", "acl": 110, "direction": "out", "deny_rate": 5000, "top_source": "10.0.20.0 0.0.255.255", "top_dest": "203.0.113.50", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 110", "deny udp 10.0.20.0 0.0.255.255 host 203.0.113.50", "exit", "interface Vlan30", "ip access-group 110 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 101, "interface": "Vlan10", "direction": "out", "src": "10.0.30.0 0.0.255.255", "dst": "192.0.2.25", "service": "tcp/22", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan10", "acl": 101, "direction": "out", "deny_hits": 5000, "existing_rules_hint": ["deny tcp 10.0.30.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 101", "permit tcp 10.0.30.0 0.0.255.255 host 192.0.2.25 eq 22", "exit", "interface Vlan10", "ip access-group 101 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "high", "acl": 150, "interface": "GigabitEthernet0/3", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/3", "acl": 150, "direction": "in", "deny_rate": 1200, "top_source": "10.0.10.0 0.0.0.63", "top_dest": "10.0.2.20", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 150", "deny tcp 10.0.10.0 0.0.0.63 host 10.0.2.20", "exit", "interface GigabitEthernet0/3", "ip access-group 150 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "medium", "acl": 110, "interface": "GigabitEthernet0/1", "direction": "in", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "acl": 110, "direction": "in", "misconfig_type": "direction", "symptom": "policy not applied"}], "cli_fix": ["interface GigabitEthernet0/1", "no ip access-group 110 in", "no ip access-group 110 out", "ip access-group 110 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 110, "interface": "Vlan20", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan20", "acl": 110, "direction": "out", "deny_rate": 500, "top_source": "10.0.20.0 0.0.0.15", "top_dest": "203.0.113.50", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 110", "permit tcp 10.0.20.0 0.0.0.15 host 203.0.113.50 eq 80", "exit", "interface Vlan20", "ip access-group 110 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "high", "acl": 110, "interface": "Vlan40", "direction": "in", "src": "192.168.1.0 0.0.255.255", "dst": "203.0.113.50", "service": "tcp/23", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan40", "acl": 110, "direction": "in", "deny_hits": 1200, "existing_rules_hint": ["deny tcp 192.168.1.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit tcp 192.168.1.0 0.0.255.255 host 203.0.113.50 eq 23", "exit", "interface Vlan40", "ip access-group 110 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "high", "acl": 199, "interface": "GigabitEthernet0/1", "direction": "out", "src": "10.0.10.0 0.0.0.63", "dst": "203.0.113.50", "service": "udp/53", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "acl": 199, "direction": "out", "deny_hits": 500, "existing_rules_hint": ["deny udp 10.0.10.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit udp 10.0.10.0 0.0.0.63 host 203.0.113.50 eq 53", "exit", "interface GigabitEthernet0/1", "ip access-group 199 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "critical", "acl": 120, "interface": "Vlan30", "direction": "in", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan30", "acl": 120, "direction": "in", "misconfig_type": "direction", "symptom": "unexpected deny"}], "cli_fix": ["interface Vlan30", "no ip access-group 120 in", "no ip access-group 120 out", "ip access-group 120 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "high", "acl": 101, "interface": "GigabitEthernet0/2", "direction": "out", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "acl": 101, "direction": "out", "deny_rate": 200, "top_source": "192.168.1.0 0.0.0.63", "top_dest": "10.0.1.10", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 101", "deny tcp 192.168.1.0 0.0.0.63 host 10.0.1.10", "exit", "interface GigabitEthernet0/2", "ip access-group 101 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "medium", "acl": 110, "interface": "Vlan50", "direction": "out", "src": "10.0.40.0 0.0.0.255", "dst": "203.0.113.50", "service": "tcp/3389", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan50", "acl": 110, "direction": "out", "deny_hits": 1200, "existing_rules_hint": ["deny tcp 10.0.40.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit tcp 10.0.40.0 0.0.0.255 host 203.0.113.50 eq 3389", "exit", "interface Vlan50", "ip access-group 110 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "high", "acl": 150, "interface": "GigabitEthernet0/0", "direction": "in", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "acl": 150, "direction": "in", "deny_rate": 5000, "top_source": "192.168.1.0 0.0.0.15", "top_dest": "192.0.2.25", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 150", "deny udp 192.168.1.0 0.0.0.15 host 192.0.2.25", "exit", "interface GigabitEthernet0/0", "ip access-group 150 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "medium", "acl": 120, "interface": "GigabitEthernet0/3", "direction": "in", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/3", "acl": 120, "direction": "in", "misconfig_type": "direction", "symptom": "policy not applied"}], "cli_fix": ["interface GigabitEthernet0/3", "no ip access-group 120 in", "no ip access-group 120 out", "ip access-group 120 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "medium", "acl": 110, "interface": "Vlan50", "direction": "in", "src": "172.16.10.0 0.0.0.255", "dst": "192.0.2.25", "service": "tcp/53", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan50", "acl": 110, "direction": "in", "deny_hits": 200, "existing_rules_hint": ["deny tcp 172.16.10.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit tcp 172.16.10.0 0.0.0.255 host 192.0.2.25 eq 53", "exit", "interface Vlan50", "ip access-group 110 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "critical", "acl": 101, "interface": "Vlan40", "direction": "in", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan40", "acl": 101, "direction": "in", "misconfig_type": "protocol", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 101", "no deny tcp 10.0.20.0 0.0.255.255 host 10.0.1.10 eq 161", "deny udp 10.0.20.0 0.0.255.255 host 10.0.1.10 eq 161", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 120, "interface": "Vlan30", "direction": "in", "src": "10.0.40.0 0.0.0.15", "dst": "10.0.3.30", "service": "tcp/8080", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan30", "acl": 120, "direction": "in", "deny_hits": 5000, "existing_rules_hint": ["deny tcp 10.0.40.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 120", "permit tcp 10.0.40.0 0.0.0.15 host 10.0.3.30 eq 8080", "exit", "interface Vlan30", "ip access-group 120 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "high", "acl": 150, "interface": "Vlan99", "direction": "out", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan99", "acl": 150, "direction": "out", "misconfig_type": "protocol", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 150", "no deny tcp 172.16.10.0 0.0.255.255 host 10.0.3.30 eq 8080", "deny udp 172.16.10.0 0.0.255.255 host 10.0.3.30 eq 8080", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 150, "interface": "Vlan99", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan99", "acl": 150, "direction": "in", "deny_rate": 200, "top_source": "10.0.10.0 0.0.0.15", "top_dest": "198.51.100.10", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 150", "deny tcp 10.0.10.0 0.0.0.15 host 198.51.100.10", "exit", "interface Vlan99", "ip access-group 150 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 100, "interface": "Vlan50", "direction": "in", "src": "172.16.10.0 0.0.0.15", "dst": "10.0.2.20", "service": "udp/443", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan50", "acl": 100, "direction": "in", "deny_hits": 5000, "existing_rules_hint": ["deny udp 172.16.10.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 100", "permit udp 172.16.10.0 0.0.0.15 host 10.0.2.20 eq 443", "exit", "interface Vlan50", "ip access-group 100 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "medium", "acl": 199, "interface": "GigabitEthernet0/3", "direction": "out", "src": "172.16.10.0 0.0.0.15", "dst": "10.0.3.30", "service": "udp/8080", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/3", "acl": 199, "direction": "out", "deny_hits": 1200, "existing_rules_hint": ["deny udp 172.16.10.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit udp 172.16.10.0 0.0.0.15 host 10.0.3.30 eq 8080", "exit", "interface GigabitEthernet0/3", "ip access-group 199 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "high", "acl": 120, "interface": "Vlan30", "direction": "out", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan30", "acl": 120, "direction": "out", "deny_rate": 500, "top_source": "172.16.10.0 0.0.255.255", "top_dest": "192.0.2.25", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 120", "permit tcp 172.16.10.0 0.0.255.255 host 192.0.2.25 eq 22", "exit", "interface Vlan30", "ip access-group 120 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "medium", "acl": 150, "interface": "Vlan10", "direction": "in", "src": "10.0.40.0 0.0.0.63", "dst": "192.0.2.25", "service": "udp/22", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan10", "acl": 150, "direction": "in", "deny_hits": 1200, "existing_rules_hint": ["deny udp 10.0.40.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 150", "permit udp 10.0.40.0 0.0.0.63 host 192.0.2.25 eq 22", "exit", "interface Vlan10", "ip access-group 150 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 100, "interface": "Vlan10", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan10", "acl": 100, "direction": "out", "deny_rate": 200, "top_source": "10.0.10.0 0.0.255.255", "top_dest": "10.0.3.30", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 100", "deny icmp 10.0.10.0 0.0.255.255 host 10.0.3.30", "exit", "interface Vlan10", "ip access-group 100 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "high", "acl": 120, "interface": "GigabitEthernet0/3", "direction": "in", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/3", "acl": 120, "direction": "in", "deny_rate": 500, "top_source": "10.0.30.0 0.0.0.15", "top_dest": "10.0.3.30", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 120", "deny icmp 10.0.30.0 0.0.0.15 host 10.0.3.30", "exit", "interface GigabitEthernet0/3", "ip access-group 120 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "high", "acl": 110, "interface": "Vlan20", "direction": "out", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan20", "acl": 110, "direction": "out", "misconfig_type": "protocol", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 110", "no deny udp 192.168.1.0 0.0.0.15 host 198.51.100.10 eq 53", "deny tcp 192.168.1.0 0.0.0.15 host 198.51.100.10 eq 53", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 100, "interface": "Vlan30", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan30", "acl": 100, "direction": "in", "deny_rate": 5000, "top_source": "10.0.40.0 0.0.0.255", "top_dest": "203.0.113.50", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 100", "deny tcp 10.0.40.0 0.0.0.255 host 203.0.113.50", "exit", "interface Vlan30", "ip access-group 100 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "high", "acl": 199, "interface": "GigabitEthernet0/0", "direction": "out", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "acl": 199, "direction": "out", "deny_rate": 1200, "top_source": "10.0.20.0 0.0.255.255", "top_dest": "192.0.2.25", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 199", "deny icmp 10.0.20.0 0.0.255.255 host 192.0.2.25", "exit", "interface GigabitEthernet0/0", "ip access-group 199 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "high", "acl": 110, "interface": "Vlan10", "direction": "in", "src": "172.16.10.0 0.0.255.255", "dst": "198.51.100.10", "service": "tcp/123", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan10", "acl": 110, "direction": "in", "deny_hits": 1200, "existing_rules_hint": ["deny tcp 172.16.10.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit tcp 172.16.10.0 0.0.255.255 host 198.51.100.10 eq 123", "exit", "interface Vlan10", "ip access-group 110 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "high", "acl": 150, "interface": "GigabitEthernet0/3", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "acl": 150, "direction": "out", "misconfig_type": "direction", "symptom": "policy not applied"}], "cli_fix": ["interface GigabitEthernet0/3", "no ip access-group 150 in", "no ip access-group 150 out", "ip access-group 150 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "high", "acl": 101, "interface": "GigabitEthernet0/3", "direction": "out", "src": "10.0.30.0 0.0.0.63", "dst": "198.51.100.10", "service": "tcp/514", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/3", "acl": 101, "direction": "out", "deny_hits": 200, "existing_rules_hint": ["deny tcp 10.0.30.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 101", "permit tcp 10.0.30.0 0.0.0.63 host 198.51.100.10 eq 514", "exit", "interface GigabitEthernet0/3", "ip access-group 101 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "high", "acl": 110, "interface": "Vlan40", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan40", "acl": 110, "direction": "out", "deny_rate": 1200, "top_source": "192.168.1.0 0.0.0.255", "top_dest": "10.0.2.20", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 110", "deny tcp 192.168.1.0 0.0.0.255 host 10.0.2.20", "exit", "interface Vlan40", "ip access-group 110 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 120, "interface": "Vlan99", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan99", "acl": 120, "direction": "out", "deny_rate": 500, "top_source": "10.0.40.0 0.0.255.255", "top_dest": "10.0.3.30", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 120", "deny tcp 10.0.40.0 0.0.255.255 host 10.0.3.30", "exit", "interface Vlan99", "ip access-group 120 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 150, "interface": "Vlan10", "direction": "in", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan10", "acl": 150, "direction": "in", "deny_rate": 200, "top_source": "10.0.30.0 0.0.0.63", "top_dest": "192.0.2.25", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 150", "permit tcp 10.0.30.0 0.0.0.63 host 192.0.2.25 eq 8080", "exit", "interface Vlan10", "ip access-group 150 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "critical", "acl": 100, "interface": "GigabitEthernet0/3", "direction": "out", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "acl": 100, "direction": "out", "misconfig_type": "wildcard", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 100", "no deny tcp 10.0.30.0 0.0.0.255 host 198.51.100.10 eq 443", "deny tcp 10.0.30.0 0.0.0.63 host 198.51.100.10 eq 443", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "medium", "acl": 120, "interface": "GigabitEthernet0/0", "direction": "in", "src": "10.0.30.0 0.0.0.255", "dst": "203.0.113.50", "service": "tcp/53", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "acl": 120, "direction": "in", "deny_hits": 200, "existing_rules_hint": ["deny tcp 10.0.30.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 120", "permit tcp 10.0.30.0 0.0.0.255 host 203.0.113.50 eq 53", "exit", "interface GigabitEthernet0/0", "ip access-group 120 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "critical", "acl": 110, "interface": "Vlan10", "direction": "in", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan10", "acl": 110, "direction": "in", "misconfig_type": "wildcard", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 110", "no deny tcp 10.0.40.0 0.0.0.255 host 192.0.2.25 eq 443", "deny tcp 10.0.40.0 0.0.0.15 host 192.0.2.25 eq 443", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "medium", "acl": 199, "interface": "GigabitEthernet0/0", "direction": "in", "src": "172.16.10.0 0.0.0.255", "dst": "10.0.1.10", "service": "udp/161", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "acl": 199, "direction": "in", "deny_hits": 5000, "existing_rules_hint": ["deny udp 172.16.10.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit udp 172.16.10.0 0.0.0.255 host 10.0.1.10 eq 161", "exit", "interface GigabitEthernet0/0", "ip access-group 199 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "critical", "acl": 100, "interface": "Vlan10", "direction": "in", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan10", "acl": 100, "direction": "in", "misconfig_type": "protocol", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 100", "no deny udp 10.0.10.0 0.0.255.255 host 203.0.113.50 eq 53", "deny tcp 10.0.10.0 0.0.255.255 host 203.0.113.50 eq 53", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "medium", "acl": 150, "interface": "Vlan20", "direction": "in", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan20", "acl": 150, "direction": "in", "deny_rate": 1200, "top_source": "10.0.30.0 0.0.255.255", "top_dest": "10.0.2.20", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 150", "permit tcp 10.0.30.0 0.0.255.255 host 10.0.2.20 eq 23", "exit", "interface Vlan20", "ip access-group 150 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "high", "acl": 199, "interface": "GigabitEthernet0/3", "direction": "in", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "acl": 199, "direction": "in", "misconfig_type": "protocol", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 199", "no deny udp 172.16.10.0 0.0.0.255 host 10.0.1.10 eq 8080", "deny tcp 172.16.10.0 0.0.0.255 host 10.0.1.10 eq 8080", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 150, "interface": "GigabitEthernet0/1", "direction": "in", "src": "10.0.40.0 0.0.0.63", "dst": "192.0.2.25", "service": "udp/443", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "acl": 150, "direction": "in", "deny_hits": 200, "existing_rules_hint": ["deny udp 10.0.40.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 150", "permit udp 10.0.40.0 0.0.0.63 host 192.0.2.25 eq 443", "exit", "interface GigabitEthernet0/1", "ip access-group 150 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "critical", "acl": 101, "interface": "Vlan20", "direction": "out", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan20", "acl": 101, "direction": "out", "misconfig_type": "protocol", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 101", "no deny udp 192.168.1.0 0.0.255.255 host 198.51.100.10 eq 22", "deny tcp 192.168.1.0 0.0.255.255 host 198.51.100.10 eq 22", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "high", "acl": 120, "interface": "GigabitEthernet0/0", "direction": "in", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "acl": 120, "direction": "in", "misconfig_type": "wildcard", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 120", "no deny tcp 10.0.40.0 0.0.0.63 host 10.0.3.30 eq 80", "deny tcp 10.0.40.0 0.0.0.15 host 10.0.3.30 eq 80", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "medium", "acl": 199, "interface": "GigabitEthernet0/1", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "acl": 199, "direction": "in", "deny_rate": 500, "top_source": "192.168.1.0 0.0.0.255", "top_dest": "10.0.3.30", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 199", "deny tcp 192.168.1.0 0.0.0.255 host 10.0.3.30", "exit", "interface GigabitEthernet0/1", "ip access-group 199 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "high", "acl": 150, "interface": "GigabitEthernet0/2", "direction": "in", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "acl": 150, "direction": "in", "deny_rate": 5000, "top_source": "172.16.10.0 0.0.0.63", "top_dest": "203.0.113.50", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 150", "deny icmp 172.16.10.0 0.0.0.63 host 203.0.113.50", "exit", "interface GigabitEthernet0/2", "ip access-group 150 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 150, "interface": "Vlan20", "direction": "in", "src": "10.0.40.0 0.0.0.15", "dst": "10.0.1.10", "service": "tcp/514", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan20", "acl": 150, "direction": "in", "deny_hits": 5000, "existing_rules_hint": ["deny tcp 10.0.40.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 150", "permit tcp 10.0.40.0 0.0.0.15 host 10.0.1.10 eq 514", "exit", "interface Vlan20", "ip access-group 150 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "high", "acl": 110, "interface": "GigabitEthernet0/3", "direction": "in", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "acl": 110, "direction": "in", "deny_rate": 500, "top_source": "172.16.10.0 0.0.0.63", "top_dest": "192.0.2.25", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 110", "deny icmp 172.16.10.0 0.0.0.63 host 192.0.2.25", "exit", "interface GigabitEthernet0/3", "ip access-group 110 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "medium", "acl": 150, "interface": "Vlan99", "direction": "out", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan99", "acl": 150, "direction": "out", "misconfig_type": "protocol", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 150", "no deny udp 10.0.20.0 0.0.0.63 host 10.0.3.30 eq 80", "deny tcp 10.0.20.0 0.0.0.63 host 10.0.3.30 eq 80", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "high", "acl": 100, "interface": "GigabitEthernet0/3", "direction": "out", "src": "192.168.1.0 0.0.0.63", "dst": "10.0.2.20", "service": "udp/514", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/3", "acl": 100, "direction": "out", "deny_hits": 500, "existing_rules_hint": ["deny udp 192.168.1.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 100", "permit udp 192.168.1.0 0.0.0.63 host 10.0.2.20 eq 514", "exit", "interface GigabitEthernet0/3", "ip access-group 100 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "high", "acl": 120, "interface": "GigabitEthernet0/3", "direction": "out", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/3", "acl": 120, "direction": "out", "misconfig_type": "wildcard", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 120", "no deny tcp 172.16.10.0 0.0.0.63 host 203.0.113.50 eq 80", "deny tcp 172.16.10.0 0.0.0.255 host 203.0.113.50 eq 80", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "medium", "acl": 150, "interface": "GigabitEthernet0/1", "direction": "in", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "acl": 150, "direction": "in", "misconfig_type": "protocol", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 150", "no deny udp 192.168.1.0 0.0.0.255 host 10.0.1.10 eq 80", "deny tcp 192.168.1.0 0.0.0.255 host 10.0.1.10 eq 80", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "critical", "acl": 120, "interface": "GigabitEthernet0/0", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "acl": 120, "direction": "out", "misconfig_type": "direction", "symptom": "policy not applied"}], "cli_fix": ["interface GigabitEthernet0/0", "no ip access-group 120 in", "no ip access-group 120 out", "ip access-group 120 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "high", "acl": 120, "interface": "GigabitEthernet0/2", "direction": "out", "src": "10.0.20.0 0.0.0.255", "dst": "203.0.113.50", "service": "tcp/161", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/2", "acl": 120, "direction": "out", "deny_hits": 1200, "existing_rules_hint": ["deny tcp 10.0.20.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 120", "permit tcp 10.0.20.0 0.0.0.255 host 203.0.113.50 eq 161", "exit", "interface GigabitEthernet0/2", "ip access-group 120 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 110, "interface": "Vlan10", "direction": "out", "src": "172.16.10.0 0.0.255.255", "dst": "198.51.100.10", "service": "tcp/443", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan10", "acl": 110, "direction": "out", "deny_hits": 500, "existing_rules_hint": ["deny tcp 172.16.10.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit tcp 172.16.10.0 0.0.255.255 host 198.51.100.10 eq 443", "exit", "interface Vlan10", "ip access-group 110 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "medium", "acl": 120, "interface": "GigabitEthernet0/1", "direction": "in", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "acl": 120, "direction": "in", "deny_rate": 1200, "top_source": "10.0.30.0 0.0.255.255", "top_dest": "192.0.2.25", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 120", "deny udp 10.0.30.0 0.0.255.255 host 192.0.2.25", "exit", "interface GigabitEthernet0/1", "ip access-group 120 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "medium", "acl": 100, "interface": "GigabitEthernet0/1", "direction": "in", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "acl": 100, "direction": "in", "deny_rate": 1200, "top_source": "10.0.40.0 0.0.0.255", "top_dest": "10.0.1.10", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 100", "permit tcp 10.0.40.0 0.0.0.255 host 10.0.1.10 eq 123", "exit", "interface GigabitEthernet0/1", "ip access-group 100 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "critical", "acl": 150, "interface": "Vlan50", "direction": "out", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan50", "acl": 150, "direction": "out", "misconfig_type": "protocol", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 150", "no deny udp 10.0.30.0 0.0.0.255 host 10.0.3.30 eq 80", "deny tcp 10.0.30.0 0.0.0.255 host 10.0.3.30 eq 80", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 101, "interface": "Vlan40", "direction": "in", "src": "172.16.10.0 0.0.0.15", "dst": "10.0.2.20", "service": "tcp/8080", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan40", "acl": 101, "direction": "in", "deny_hits": 500, "existing_rules_hint": ["deny tcp 172.16.10.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 101", "permit tcp 172.16.10.0 0.0.0.15 host 10.0.2.20 eq 8080", "exit", "interface Vlan40", "ip access-group 101 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 199, "interface": "GigabitEthernet0/2", "direction": "in", "src": "172.16.10.0 0.0.0.15", "dst": "198.51.100.10", "service": "udp/8080", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "acl": 199, "direction": "in", "deny_hits": 500, "existing_rules_hint": ["deny udp 172.16.10.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit udp 172.16.10.0 0.0.0.15 host 198.51.100.10 eq 8080", "exit", "interface GigabitEthernet0/2", "ip access-group 199 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "high", "acl": 110, "interface": "GigabitEthernet0/1", "direction": "in", "src": "172.16.10.0 0.0.0.63", "dst": "10.0.1.10", "service": "tcp/80", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "acl": 110, "direction": "in", "deny_hits": 5000, "existing_rules_hint": ["deny tcp 172.16.10.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit tcp 172.16.10.0 0.0.0.63 host 10.0.1.10 eq 80", "exit", "interface GigabitEthernet0/1", "ip access-group 110 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "high", "acl": 110, "interface": "Vlan30", "direction": "out", "src": "10.0.30.0 0.0.0.63", "dst": "198.51.100.10", "service": "udp/23", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan30", "acl": 110, "direction": "out", "deny_hits": 500, "existing_rules_hint": ["deny udp 10.0.30.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit udp 10.0.30.0 0.0.0.63 host 198.51.100.10 eq 23", "exit", "interface Vlan30", "ip access-group 110 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 199, "interface": "Vlan99", "direction": "in", "src": "10.0.30.0 0.0.255.255", "dst": "10.0.3.30", "service": "tcp/123", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan99", "acl": 199, "direction": "in", "deny_hits": 5000, "existing_rules_hint": ["deny tcp 10.0.30.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit tcp 10.0.30.0 0.0.255.255 host 10.0.3.30 eq 123", "exit", "interface Vlan99", "ip access-group 199 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "medium", "acl": 101, "interface": "Vlan99", "direction": "out", "src": "10.0.10.0 0.0.0.15", "dst": "10.0.2.20", "service": "tcp/53", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan99", "acl": 101, "direction": "out", "deny_hits": 1200, "existing_rules_hint": ["deny tcp 10.0.10.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 101", "permit tcp 10.0.10.0 0.0.0.15 host 10.0.2.20 eq 53", "exit", "interface Vlan99", "ip access-group 101 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "high", "acl": 100, "interface": "Vlan99", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan99", "acl": 100, "direction": "out", "deny_rate": 1200, "top_source": "10.0.40.0 0.0.0.15", "top_dest": "10.0.3.30", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 100", "deny tcp 10.0.40.0 0.0.0.15 host 10.0.3.30", "exit", "interface Vlan99", "ip access-group 100 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "high", "acl": 110, "interface": "Vlan30", "direction": "in", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan30", "acl": 110, "direction": "in", "misconfig_type": "direction", "symptom": "unexpected permit"}], "cli_fix": ["interface Vlan30", "no ip access-group 110 in", "no ip access-group 110 out", "ip access-group 110 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "high", "acl": 101, "interface": "GigabitEthernet0/3", "direction": "in", "src": "172.16.10.0 0.0.255.255", "dst": "198.51.100.10", "service": "tcp/514", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/3", "acl": 101, "direction": "in", "deny_hits": 5000, "existing_rules_hint": ["deny tcp 172.16.10.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 101", "permit tcp 172.16.10.0 0.0.255.255 host 198.51.100.10 eq 514", "exit", "interface GigabitEthernet0/3", "ip access-group 101 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "high", "acl": 150, "interface": "GigabitEthernet0/1", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "acl": 150, "direction": "out", "misconfig_type": "direction", "symptom": "unexpected deny"}], "cli_fix": ["interface GigabitEthernet0/1", "no ip access-group 150 in", "no ip access-group 150 out", "ip access-group 150 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 101, "interface": "GigabitEthernet0/1", "direction": "in", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "acl": 101, "direction": "in", "deny_rate": 500, "top_source": "10.0.30.0 0.0.0.255", "top_dest": "10.0.3.30", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 101", "deny tcp 10.0.30.0 0.0.0.255 host 10.0.3.30", "exit", "interface GigabitEthernet0/1", "ip access-group 101 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 110, "interface": "GigabitEthernet0/3", "direction": "out", "src": "10.0.40.0 0.0.0.15", "dst": "198.51.100.10", "service": "tcp/80", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/3", "acl": 110, "direction": "out", "deny_hits": 500, "existing_rules_hint": ["deny tcp 10.0.40.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit tcp 10.0.40.0 0.0.0.15 host 198.51.100.10 eq 80", "exit", "interface GigabitEthernet0/3", "ip access-group 110 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 150, "interface": "GigabitEthernet0/2", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/2", "acl": 150, "direction": "out", "deny_rate": 200, "top_source": "10.0.10.0 0.0.0.255", "top_dest": "192.0.2.25", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 150", "permit tcp 10.0.10.0 0.0.0.255 host 192.0.2.25 eq 161", "exit", "interface GigabitEthernet0/2", "ip access-group 150 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "medium", "acl": 150, "interface": "Vlan30", "direction": "in", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan30", "acl": 150, "direction": "in", "misconfig_type": "protocol", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 150", "no deny tcp 172.16.10.0 0.0.0.255 host 198.51.100.10 eq 443", "deny udp 172.16.10.0 0.0.0.255 host 198.51.100.10 eq 443", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 100, "interface": "GigabitEthernet0/1", "direction": "in", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "acl": 100, "direction": "in", "deny_rate": 200, "top_source": "10.0.10.0 0.0.0.15", "top_dest": "203.0.113.50", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 100", "permit tcp 10.0.10.0 0.0.0.15 host 203.0.113.50 eq 3389", "exit", "interface GigabitEthernet0/1", "ip access-group 100 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 199, "interface": "Vlan30", "direction": "in", "src": "10.0.30.0 0.0.0.255", "dst": "192.0.2.25", "service": "udp/23", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan30", "acl": 199, "direction": "in", "deny_hits": 500, "existing_rules_hint": ["deny udp 10.0.30.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit udp 10.0.30.0 0.0.0.255 host 192.0.2.25 eq 23", "exit", "interface Vlan30", "ip access-group 199 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "medium", "acl": 150, "interface": "Vlan10", "direction": "in", "src": "10.0.30.0 0.0.0.63", "dst": "10.0.2.20", "service": "udp/23", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan10", "acl": 150, "direction": "in", "deny_hits": 500, "existing_rules_hint": ["deny udp 10.0.30.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 150", "permit udp 10.0.30.0 0.0.0.63 host 10.0.2.20 eq 23", "exit", "interface Vlan10", "ip access-group 150 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "high", "acl": 120, "interface": "GigabitEthernet0/0", "direction": "in", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "acl": 120, "direction": "in", "misconfig_type": "direction", "symptom": "policy not applied"}], "cli_fix": ["interface GigabitEthernet0/0", "no ip access-group 120 in", "no ip access-group 120 out", "ip access-group 120 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "medium", "acl": 150, "interface": "GigabitEthernet0/1", "direction": "out", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "acl": 150, "direction": "out", "misconfig_type": "protocol", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 150", "no deny tcp 10.0.40.0 0.0.0.15 host 198.51.100.10 eq 22", "deny udp 10.0.40.0 0.0.0.15 host 198.51.100.10 eq 22", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 199, "interface": "Vlan20", "direction": "out", "src": "10.0.10.0 0.0.0.63", "dst": "10.0.1.10", "service": "udp/22", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan20", "acl": 199, "direction": "out", "deny_hits": 1200, "existing_rules_hint": ["deny udp 10.0.10.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit udp 10.0.10.0 0.0.0.63 host 10.0.1.10 eq 22", "exit", "interface Vlan20", "ip access-group 199 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 110, "interface": "Vlan10", "direction": "out", "src": "10.0.30.0 0.0.0.255", "dst": "198.51.100.10", "service": "udp/3389", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan10", "acl": 110, "direction": "out", "deny_hits": 5000, "existing_rules_hint": ["deny udp 10.0.30.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit udp 10.0.30.0 0.0.0.255 host 198.51.100.10 eq 3389", "exit", "interface Vlan10", "ip access-group 110 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "high", "acl": 100, "interface": "GigabitEthernet0/3", "direction": "in", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "acl": 100, "direction": "in", "misconfig_type": "wildcard", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 100", "no deny tcp 172.16.10.0 0.0.255.255 host 198.51.100.10 eq 161", "deny tcp 172.16.10.0 0.0.0.63 host 198.51.100.10 eq 161", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "medium", "acl": 120, "interface": "Vlan30", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan30", "acl": 120, "direction": "out", "misconfig_type": "direction", "symptom": "unexpected deny"}], "cli_fix": ["interface Vlan30", "no ip access-group 120 in", "no ip access-group 120 out", "ip access-group 120 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 110, "interface": "Vlan99", "direction": "out", "src": "10.0.30.0 0.0.0.15", "dst": "192.0.2.25", "service": "tcp/161", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan99", "acl": 110, "direction": "out", "deny_hits": 500, "existing_rules_hint": ["deny tcp 10.0.30.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit tcp 10.0.30.0 0.0.0.15 host 192.0.2.25 eq 161", "exit", "interface Vlan99", "ip access-group 110 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "high", "acl": 150, "interface": "Vlan20", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan20", "acl": 150, "direction": "in", "deny_rate": 1200, "top_source": "172.16.10.0 0.0.255.255", "top_dest": "10.0.3.30", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 150", "permit tcp 172.16.10.0 0.0.255.255 host 10.0.3.30 eq 3389", "exit", "interface Vlan20", "ip access-group 150 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "high", "acl": 150, "interface": "Vlan99", "direction": "in", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan99", "acl": 150, "direction": "in", "misconfig_type": "wildcard", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 150", "no deny tcp 172.16.10.0 0.0.0.63 host 192.0.2.25 eq 80", "deny tcp 172.16.10.0 0.0.255.255 host 192.0.2.25 eq 80", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 199, "interface": "GigabitEthernet0/0", "direction": "out", "src": "192.168.1.0 0.0.0.255", "dst": "203.0.113.50", "service": "udp/443", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "acl": 199, "direction": "out", "deny_hits": 200, "existing_rules_hint": ["deny udp 192.168.1.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit udp 192.168.1.0 0.0.0.255 host 203.0.113.50 eq 443", "exit", "interface GigabitEthernet0/0", "ip access-group 199 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "medium", "acl": 120, "interface": "Vlan50", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan50", "acl": 120, "direction": "out", "deny_rate": 200, "top_source": "172.16.10.0 0.0.0.15", "top_dest": "10.0.2.20", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 120", "permit tcp 172.16.10.0 0.0.0.15 host 10.0.2.20 eq 161", "exit", "interface Vlan50", "ip access-group 120 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "high", "acl": 150, "interface": "GigabitEthernet0/0", "direction": "out", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "acl": 150, "direction": "out", "deny_rate": 500, "top_source": "10.0.30.0 0.0.255.255", "top_dest": "192.0.2.25", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 150", "permit tcp 10.0.30.0 0.0.255.255 host 192.0.2.25 eq 123", "exit", "interface GigabitEthernet0/0", "ip access-group 150 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "medium", "acl": 120, "interface": "GigabitEthernet0/2", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "acl": 120, "direction": "out", "deny_rate": 1200, "top_source": "172.16.10.0 0.0.0.255", "top_dest": "10.0.3.30", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 120", "permit tcp 172.16.10.0 0.0.0.255 host 10.0.3.30 eq 80", "exit", "interface GigabitEthernet0/2", "ip access-group 120 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "critical", "acl": 101, "interface": "GigabitEthernet0/2", "direction": "out", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "acl": 101, "direction": "out", "misconfig_type": "wildcard", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 101", "no deny tcp 10.0.30.0 0.0.0.255 host 203.0.113.50 eq 161", "deny tcp 10.0.30.0 0.0.0.63 host 203.0.113.50 eq 161", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "medium", "acl": 101, "interface": "Vlan40", "direction": "in", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan40", "acl": 101, "direction": "in", "deny_rate": 200, "top_source": "10.0.20.0 0.0.0.63", "top_dest": "192.0.2.25", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 101", "permit tcp 10.0.20.0 0.0.0.63 host 192.0.2.25 eq 53", "exit", "interface Vlan40", "ip access-group 101 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 199, "interface": "Vlan20", "direction": "out", "src": "10.0.20.0 0.0.255.255", "dst": "203.0.113.50", "service": "udp/53", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan20", "acl": 199, "direction": "out", "deny_hits": 500, "existing_rules_hint": ["deny udp 10.0.20.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit udp 10.0.20.0 0.0.255.255 host 203.0.113.50 eq 53", "exit", "interface Vlan20", "ip access-group 199 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "high", "acl": 110, "interface": "Vlan20", "direction": "in", "src": "10.0.10.0 0.0.255.255", "dst": "10.0.1.10", "service": "udp/80", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan20", "acl": 110, "direction": "in", "deny_hits": 5000, "existing_rules_hint": ["deny udp 10.0.10.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit udp 10.0.10.0 0.0.255.255 host 10.0.1.10 eq 80", "exit", "interface Vlan20", "ip access-group 110 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "medium", "acl": 120, "interface": "GigabitEthernet0/1", "direction": "out", "src": "172.16.10.0 0.0.0.63", "dst": "10.0.2.20", "service": "udp/80", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "acl": 120, "direction": "out", "deny_hits": 1200, "existing_rules_hint": ["deny udp 172.16.10.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 120", "permit udp 172.16.10.0 0.0.0.63 host 10.0.2.20 eq 80", "exit", "interface GigabitEthernet0/1", "ip access-group 120 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "high", "acl": 101, "interface": "GigabitEthernet0/2", "direction": "out", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "acl": 101, "direction": "out", "misconfig_type": "wildcard", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 101", "no deny udp 10.0.10.0 0.0.255.255 host 198.51.100.10 eq 22", "deny udp 10.0.10.0 0.0.0.15 host 198.51.100.10 eq 22", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "high", "acl": 101, "interface": "Vlan40", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan40", "acl": 101, "direction": "in", "deny_rate": 1200, "top_source": "10.0.30.0 0.0.0.15", "top_dest": "198.51.100.10", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 101", "permit tcp 10.0.30.0 0.0.0.15 host 198.51.100.10 eq 123", "exit", "interface Vlan40", "ip access-group 101 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "critical", "acl": 110, "interface": "GigabitEthernet0/2", "direction": "out", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "acl": 110, "direction": "out", "misconfig_type": "wildcard", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 110", "no deny tcp 10.0.10.0 0.0.0.63 host 10.0.3.30 eq 443", "deny tcp 10.0.10.0 0.0.0.255 host 10.0.3.30 eq 443", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "high", "acl": 199, "interface": "Vlan40", "direction": "out", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan40", "acl": 199, "direction": "out", "deny_rate": 200, "top_source": "172.16.10.0 0.0.0.15", "top_dest": "10.0.3.30", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 199", "permit tcp 172.16.10.0 0.0.0.15 host 10.0.3.30 eq 53", "exit", "interface Vlan40", "ip access-group 199 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "high", "acl": 120, "interface": "Vlan40", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan40", "acl": 120, "direction": "out", "misconfig_type": "direction", "symptom": "unexpected permit"}], "cli_fix": ["interface Vlan40", "no ip access-group 120 in", "no ip access-group 120 out", "ip access-group 120 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "medium", "acl": 100, "interface": "GigabitEthernet0/1", "direction": "out", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "acl": 100, "direction": "out", "misconfig_type": "protocol", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 100", "no deny udp 10.0.10.0 0.0.0.255 host 203.0.113.50 eq 22", "deny tcp 10.0.10.0 0.0.0.255 host 203.0.113.50 eq 22", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "high", "acl": 100, "interface": "Vlan50", "direction": "out", "src": "192.168.1.0 0.0.0.63", "dst": "203.0.113.50", "service": "udp/8080", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan50", "acl": 100, "direction": "out", "deny_hits": 5000, "existing_rules_hint": ["deny udp 192.168.1.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 100", "permit udp 192.168.1.0 0.0.0.63 host 203.0.113.50 eq 8080", "exit", "interface Vlan50", "ip access-group 100 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "high", "acl": 100, "interface": "Vlan20", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan20", "acl": 100, "direction": "in", "deny_rate": 200, "top_source": "10.0.30.0 0.0.0.15", "top_dest": "10.0.1.10", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 100", "permit tcp 10.0.30.0 0.0.0.15 host 10.0.1.10 eq 3389", "exit", "interface Vlan20", "ip access-group 100 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "critical", "acl": 150, "interface": "Vlan10", "direction": "out", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan10", "acl": 150, "direction": "out", "misconfig_type": "wildcard", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 150", "no deny udp 10.0.30.0 0.0.0.15 host 203.0.113.50 eq 53", "deny udp 10.0.30.0 0.0.0.255 host 203.0.113.50 eq 53", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "medium", "acl": 199, "interface": "GigabitEthernet0/2", "direction": "in", "src": "10.0.10.0 0.0.255.255", "dst": "10.0.1.10", "service": "tcp/3389", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "acl": 199, "direction": "in", "deny_hits": 200, "existing_rules_hint": ["deny tcp 10.0.10.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit tcp 10.0.10.0 0.0.255.255 host 10.0.1.10 eq 3389", "exit", "interface GigabitEthernet0/2", "ip access-group 199 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "high", "acl": 150, "interface": "Vlan30", "direction": "in", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan30", "acl": 150, "direction": "in", "deny_rate": 500, "top_source": "172.16.10.0 0.0.255.255", "top_dest": "203.0.113.50", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 150", "permit tcp 172.16.10.0 0.0.255.255 host 203.0.113.50 eq 22", "exit", "interface Vlan30", "ip access-group 150 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 120, "interface": "GigabitEthernet0/0", "direction": "out", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "acl": 120, "direction": "out", "deny_rate": 1200, "top_source": "10.0.40.0 0.0.0.255", "top_dest": "192.0.2.25", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 120", "permit tcp 10.0.40.0 0.0.0.255 host 192.0.2.25 eq 53", "exit", "interface GigabitEthernet0/0", "ip access-group 120 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 101, "interface": "Vlan99", "direction": "in", "src": "10.0.10.0 0.0.0.63", "dst": "10.0.3.30", "service": "udp/123", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan99", "acl": 101, "direction": "in", "deny_hits": 1200, "existing_rules_hint": ["deny udp 10.0.10.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 101", "permit udp 10.0.10.0 0.0.0.63 host 10.0.3.30 eq 123", "exit", "interface Vlan99", "ip access-group 101 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "medium", "acl": 120, "interface": "Vlan10", "direction": "out", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan10", "acl": 120, "direction": "out", "misconfig_type": "protocol", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 120", "no deny tcp 10.0.20.0 0.0.0.255 host 10.0.2.20 eq 123", "deny udp 10.0.20.0 0.0.0.255 host 10.0.2.20 eq 123", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 150, "interface": "Vlan30", "direction": "in", "src": "10.0.10.0 0.0.255.255", "dst": "10.0.2.20", "service": "udp/23", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan30", "acl": 150, "direction": "in", "deny_hits": 5000, "existing_rules_hint": ["deny udp 10.0.10.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 150", "permit udp 10.0.10.0 0.0.255.255 host 10.0.2.20 eq 23", "exit", "interface Vlan30", "ip access-group 150 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "high", "acl": 101, "interface": "Vlan20", "direction": "out", "src": "10.0.30.0 0.0.0.255", "dst": "192.0.2.25", "service": "tcp/161", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan20", "acl": 101, "direction": "out", "deny_hits": 5000, "existing_rules_hint": ["deny tcp 10.0.30.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 101", "permit tcp 10.0.30.0 0.0.0.255 host 192.0.2.25 eq 161", "exit", "interface Vlan20", "ip access-group 101 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 110, "interface": "Vlan99", "direction": "out", "src": "10.0.20.0 0.0.0.255", "dst": "10.0.1.10", "service": "udp/80", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan99", "acl": 110, "direction": "out", "deny_hits": 5000, "existing_rules_hint": ["deny udp 10.0.20.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit udp 10.0.20.0 0.0.0.255 host 10.0.1.10 eq 80", "exit", "interface Vlan99", "ip access-group 110 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "high", "acl": 101, "interface": "Vlan99", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan99", "acl": 101, "direction": "in", "deny_rate": 1200, "top_source": "10.0.10.0 0.0.0.255", "top_dest": "10.0.2.20", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 101", "permit tcp 10.0.10.0 0.0.0.255 host 10.0.2.20 eq 53", "exit", "interface Vlan99", "ip access-group 101 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "medium", "acl": 100, "interface": "Vlan50", "direction": "out", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan50", "acl": 100, "direction": "out", "misconfig_type": "wildcard", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 100", "no deny tcp 10.0.40.0 0.0.0.63 host 192.0.2.25 eq 161", "deny tcp 10.0.40.0 0.0.255.255 host 192.0.2.25 eq 161", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "high", "acl": 100, "interface": "GigabitEthernet0/1", "direction": "out", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "acl": 100, "direction": "out", "deny_rate": 200, "top_source": "172.16.10.0 0.0.0.255", "top_dest": "192.0.2.25", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 100", "deny icmp 172.16.10.0 0.0.0.255 host 192.0.2.25", "exit", "interface GigabitEthernet0/1", "ip access-group 100 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 120, "interface": "Vlan50", "direction": "in", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan50", "acl": 120, "direction": "in", "deny_rate": 1200, "top_source": "10.0.40.0 0.0.0.15", "top_dest": "203.0.113.50", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 120", "permit tcp 10.0.40.0 0.0.0.15 host 203.0.113.50 eq 123", "exit", "interface Vlan50", "ip access-group 120 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "high", "acl": 110, "interface": "GigabitEthernet0/0", "direction": "out", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "acl": 110, "direction": "out", "misconfig_type": "protocol", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 110", "no deny tcp 10.0.20.0 0.0.255.255 host 10.0.2.20 eq 3389", "deny udp 10.0.20.0 0.0.255.255 host 10.0.2.20 eq 3389", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 110, "interface": "Vlan30", "direction": "out", "src": "172.16.10.0 0.0.0.63", "dst": "192.0.2.25", "service": "tcp/22", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan30", "acl": 110, "direction": "out", "deny_hits": 200, "existing_rules_hint": ["deny tcp 172.16.10.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit tcp 172.16.10.0 0.0.0.63 host 192.0.2.25 eq 22", "exit", "interface Vlan30", "ip access-group 110 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "high", "acl": 120, "interface": "Vlan40", "direction": "in", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan40", "acl": 120, "direction": "in", "misconfig_type": "wildcard", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 120", "no deny udp 192.168.1.0 0.0.0.63 host 192.0.2.25 eq 23", "deny udp 192.168.1.0 0.0.0.15 host 192.0.2.25 eq 23", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 101, "interface": "GigabitEthernet0/0", "direction": "out", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "acl": 101, "direction": "out", "deny_rate": 1200, "top_source": "192.168.1.0 0.0.255.255", "top_dest": "10.0.2.20", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 101", "permit tcp 192.168.1.0 0.0.255.255 host 10.0.2.20 eq 161", "exit", "interface GigabitEthernet0/0", "ip access-group 101 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "high", "acl": 120, "interface": "Vlan99", "direction": "out", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan99", "acl": 120, "direction": "out", "misconfig_type": "wildcard", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 120", "no deny udp 10.0.30.0 0.0.0.15 host 10.0.1.10 eq 23", "deny udp 10.0.30.0 0.0.255.255 host 10.0.1.10 eq 23", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "medium", "acl": 150, "interface": "Vlan20", "direction": "in", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan20", "acl": 150, "direction": "in", "misconfig_type": "direction", "symptom": "unexpected permit"}], "cli_fix": ["interface Vlan20", "no ip access-group 150 in", "no ip access-group 150 out", "ip access-group 150 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "medium", "acl": 110, "interface": "GigabitEthernet0/1", "direction": "out", "src": "172.16.10.0 0.0.0.15", "dst": "10.0.1.10", "service": "udp/123", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "acl": 110, "direction": "out", "deny_hits": 1200, "existing_rules_hint": ["deny udp 172.16.10.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit udp 172.16.10.0 0.0.0.15 host 10.0.1.10 eq 123", "exit", "interface GigabitEthernet0/1", "ip access-group 110 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "high", "acl": 101, "interface": "GigabitEthernet0/1", "direction": "in", "src": "10.0.30.0 0.0.0.15", "dst": "192.0.2.25", "service": "tcp/53", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "acl": 101, "direction": "in", "deny_hits": 200, "existing_rules_hint": ["deny tcp 10.0.30.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 101", "permit tcp 10.0.30.0 0.0.0.15 host 192.0.2.25 eq 53", "exit", "interface GigabitEthernet0/1", "ip access-group 101 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "medium", "acl": 120, "interface": "GigabitEthernet0/3", "direction": "in", "src": "10.0.40.0 0.0.255.255", "dst": "203.0.113.50", "service": "tcp/22", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "acl": 120, "direction": "in", "deny_hits": 200, "existing_rules_hint": ["deny tcp 10.0.40.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 120", "permit tcp 10.0.40.0 0.0.255.255 host 203.0.113.50 eq 22", "exit", "interface GigabitEthernet0/3", "ip access-group 120 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 120, "interface": "Vlan20", "direction": "in", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan20", "acl": 120, "direction": "in", "deny_rate": 200, "top_source": "10.0.10.0 0.0.0.255", "top_dest": "192.0.2.25", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 120", "permit tcp 10.0.10.0 0.0.0.255 host 192.0.2.25 eq 23", "exit", "interface Vlan20", "ip access-group 120 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "high", "acl": 110, "interface": "GigabitEthernet0/1", "direction": "in", "src": "192.168.1.0 0.0.255.255", "dst": "10.0.2.20", "service": "tcp/514", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "acl": 110, "direction": "in", "deny_hits": 200, "existing_rules_hint": ["deny tcp 192.168.1.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit tcp 192.168.1.0 0.0.255.255 host 10.0.2.20 eq 514", "exit", "interface GigabitEthernet0/1", "ip access-group 110 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "high", "acl": 110, "interface": "GigabitEthernet0/0", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "acl": 110, "direction": "out", "deny_rate": 5000, "top_source": "172.16.10.0 0.0.0.15", "top_dest": "203.0.113.50", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 110", "deny icmp 172.16.10.0 0.0.0.15 host 203.0.113.50", "exit", "interface GigabitEthernet0/0", "ip access-group 110 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 110, "interface": "Vlan40", "direction": "out", "src": "10.0.30.0 0.0.0.255", "dst": "10.0.2.20", "service": "udp/161", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan40", "acl": 110, "direction": "out", "deny_hits": 1200, "existing_rules_hint": ["deny udp 10.0.30.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit udp 10.0.30.0 0.0.0.255 host 10.0.2.20 eq 161", "exit", "interface Vlan40", "ip access-group 110 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "critical", "acl": 110, "interface": "Vlan40", "direction": "out", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan40", "acl": 110, "direction": "out", "misconfig_type": "protocol", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 110", "no deny tcp 10.0.10.0 0.0.0.63 host 10.0.3.30 eq 514", "deny udp 10.0.10.0 0.0.0.63 host 10.0.3.30 eq 514", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 100, "interface": "GigabitEthernet0/1", "direction": "in", "src": "192.168.1.0 0.0.255.255", "dst": "10.0.2.20", "service": "udp/123", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "acl": 100, "direction": "in", "deny_hits": 500, "existing_rules_hint": ["deny udp 192.168.1.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 100", "permit udp 192.168.1.0 0.0.255.255 host 10.0.2.20 eq 123", "exit", "interface GigabitEthernet0/1", "ip access-group 100 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "medium", "acl": 199, "interface": "Vlan10", "direction": "out", "src": "10.0.40.0 0.0.0.255", "dst": "10.0.1.10", "service": "tcp/80", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan10", "acl": 199, "direction": "out", "deny_hits": 1200, "existing_rules_hint": ["deny tcp 10.0.40.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit tcp 10.0.40.0 0.0.0.255 host 10.0.1.10 eq 80", "exit", "interface Vlan10", "ip access-group 199 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "critical", "acl": 101, "interface": "GigabitEthernet0/1", "direction": "out", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "acl": 101, "direction": "out", "misconfig_type": "wildcard", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 101", "no deny udp 192.168.1.0 0.0.255.255 host 10.0.2.20 eq 514", "deny udp 192.168.1.0 0.0.0.255 host 10.0.2.20 eq 514", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "medium", "acl": 100, "interface": "Vlan99", "direction": "in", "src": "10.0.40.0 0.0.0.255", "dst": "192.0.2.25", "service": "tcp/80", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan99", "acl": 100, "direction": "in", "deny_hits": 1200, "existing_rules_hint": ["deny tcp 10.0.40.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 100", "permit tcp 10.0.40.0 0.0.0.255 host 192.0.2.25 eq 80", "exit", "interface Vlan99", "ip access-group 100 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 120, "interface": "Vlan10", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan10", "acl": 120, "direction": "in", "deny_rate": 1200, "top_source": "10.0.40.0 0.0.0.255", "top_dest": "10.0.2.20", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 120", "permit tcp 10.0.40.0 0.0.0.255 host 10.0.2.20 eq 80", "exit", "interface Vlan10", "ip access-group 120 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "medium", "acl": 110, "interface": "Vlan50", "direction": "out", "src": "10.0.30.0 0.0.0.15", "dst": "192.0.2.25", "service": "tcp/3389", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan50", "acl": 110, "direction": "out", "deny_hits": 200, "existing_rules_hint": ["deny tcp 10.0.30.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit tcp 10.0.30.0 0.0.0.15 host 192.0.2.25 eq 3389", "exit", "interface Vlan50", "ip access-group 110 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 150, "interface": "GigabitEthernet0/0", "direction": "out", "src": "10.0.10.0 0.0.0.15", "dst": "10.0.1.10", "service": "udp/123", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "acl": 150, "direction": "out", "deny_hits": 1200, "existing_rules_hint": ["deny udp 10.0.10.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 150", "permit udp 10.0.10.0 0.0.0.15 host 10.0.1.10 eq 123", "exit", "interface GigabitEthernet0/0", "ip access-group 150 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "high", "acl": 150, "interface": "GigabitEthernet0/0", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/0", "acl": 150, "direction": "out", "deny_rate": 5000, "top_source": "10.0.20.0 0.0.0.255", "top_dest": "192.0.2.25", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 150", "permit tcp 10.0.20.0 0.0.0.255 host 192.0.2.25 eq 3389", "exit", "interface GigabitEthernet0/0", "ip access-group 150 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "medium", "acl": 199, "interface": "Vlan50", "direction": "in", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan50", "acl": 199, "direction": "in", "misconfig_type": "protocol", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 199", "no deny udp 10.0.20.0 0.0.0.63 host 10.0.2.20 eq 53", "deny tcp 10.0.20.0 0.0.0.63 host 10.0.2.20 eq 53", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "high", "acl": 110, "interface": "Vlan50", "direction": "out", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan50", "acl": 110, "direction": "out", "deny_rate": 1200, "top_source": "192.168.1.0 0.0.0.255", "top_dest": "10.0.1.10", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 110", "deny udp 192.168.1.0 0.0.0.255 host 10.0.1.10", "exit", "interface Vlan50", "ip access-group 110 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 199, "interface": "GigabitEthernet0/3", "direction": "in", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/3", "acl": 199, "direction": "in", "deny_rate": 200, "top_source": "192.168.1.0 0.0.0.255", "top_dest": "198.51.100.10", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 199", "deny udp 192.168.1.0 0.0.0.255 host 198.51.100.10", "exit", "interface GigabitEthernet0/3", "ip access-group 199 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 199, "interface": "GigabitEthernet0/2", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "acl": 199, "direction": "in", "deny_rate": 1200, "top_source": "172.16.10.0 0.0.0.15", "top_dest": "192.0.2.25", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 199", "permit tcp 172.16.10.0 0.0.0.15 host 192.0.2.25 eq 53", "exit", "interface GigabitEthernet0/2", "ip access-group 199 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "medium", "acl": 150, "interface": "Vlan30", "direction": "in", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan30", "acl": 150, "direction": "in", "misconfig_type": "protocol", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 150", "no deny tcp 10.0.40.0 0.0.255.255 host 10.0.1.10 eq 514", "deny udp 10.0.40.0 0.0.255.255 host 10.0.1.10 eq 514", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "high", "acl": 101, "interface": "GigabitEthernet0/0", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "acl": 101, "direction": "out", "deny_rate": 500, "top_source": "192.168.1.0 0.0.0.255", "top_dest": "10.0.2.20", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 101", "permit tcp 192.168.1.0 0.0.0.255 host 10.0.2.20 eq 23", "exit", "interface GigabitEthernet0/0", "ip access-group 101 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "medium", "acl": 199, "interface": "GigabitEthernet0/2", "direction": "in", "src": "10.0.30.0 0.0.0.15", "dst": "198.51.100.10", "service": "udp/3389", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/2", "acl": 199, "direction": "in", "deny_hits": 500, "existing_rules_hint": ["deny udp 10.0.30.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit udp 10.0.30.0 0.0.0.15 host 198.51.100.10 eq 3389", "exit", "interface GigabitEthernet0/2", "ip access-group 199 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "medium", "acl": 120, "interface": "GigabitEthernet0/1", "direction": "out", "src": "10.0.20.0 0.0.255.255", "dst": "10.0.3.30", "service": "udp/123", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "acl": 120, "direction": "out", "deny_hits": 500, "existing_rules_hint": ["deny udp 10.0.20.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 120", "permit udp 10.0.20.0 0.0.255.255 host 10.0.3.30 eq 123", "exit", "interface GigabitEthernet0/1", "ip access-group 120 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "high", "acl": 100, "interface": "Vlan50", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan50", "acl": 100, "direction": "out", "deny_rate": 500, "top_source": "10.0.20.0 0.0.0.15", "top_dest": "198.51.100.10", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 100", "permit tcp 10.0.20.0 0.0.0.15 host 198.51.100.10 eq 514", "exit", "interface Vlan50", "ip access-group 100 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "high", "acl": 120, "interface": "GigabitEthernet0/3", "direction": "out", "src": "10.0.20.0 0.0.255.255", "dst": "198.51.100.10", "service": "tcp/8080", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/3", "acl": 120, "direction": "out", "deny_hits": 500, "existing_rules_hint": ["deny tcp 10.0.20.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 120", "permit tcp 10.0.20.0 0.0.255.255 host 198.51.100.10 eq 8080", "exit", "interface GigabitEthernet0/3", "ip access-group 120 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "medium", "acl": 199, "interface": "Vlan10", "direction": "in", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan10", "acl": 199, "direction": "in", "misconfig_type": "wildcard", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 199", "no deny tcp 10.0.20.0 0.0.0.63 host 203.0.113.50 eq 80", "deny tcp 10.0.20.0 0.0.0.255 host 203.0.113.50 eq 80", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "high", "acl": 120, "interface": "GigabitEthernet0/0", "direction": "out", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/0", "acl": 120, "direction": "out", "deny_rate": 500, "top_source": "192.168.1.0 0.0.0.15", "top_dest": "192.0.2.25", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 120", "permit tcp 192.168.1.0 0.0.0.15 host 192.0.2.25 eq 123", "exit", "interface GigabitEthernet0/0", "ip access-group 120 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "critical", "acl": 120, "interface": "Vlan40", "direction": "in", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan40", "acl": 120, "direction": "in", "misconfig_type": "protocol", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 120", "no deny udp 10.0.40.0 0.0.255.255 host 10.0.2.20 eq 443", "deny tcp 10.0.40.0 0.0.255.255 host 10.0.2.20 eq 443", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "high", "acl": 101, "interface": "GigabitEthernet0/0", "direction": "out", "src": "10.0.10.0 0.0.0.255", "dst": "203.0.113.50", "service": "tcp/3389", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "acl": 101, "direction": "out", "deny_hits": 5000, "existing_rules_hint": ["deny tcp 10.0.10.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 101", "permit tcp 10.0.10.0 0.0.0.255 host 203.0.113.50 eq 3389", "exit", "interface GigabitEthernet0/0", "ip access-group 101 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "high", "acl": 110, "interface": "GigabitEthernet0/3", "direction": "in", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/3", "acl": 110, "direction": "in", "misconfig_type": "protocol", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 110", "no deny udp 172.16.10.0 0.0.255.255 host 192.0.2.25 eq 80", "deny tcp 172.16.10.0 0.0.255.255 host 192.0.2.25 eq 80", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "medium", "acl": 100, "interface": "GigabitEthernet0/3", "direction": "in", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "acl": 100, "direction": "in", "misconfig_type": "direction", "symptom": "unexpected deny"}], "cli_fix": ["interface GigabitEthernet0/3", "no ip access-group 100 in", "no ip access-group 100 out", "ip access-group 100 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "critical", "acl": 110, "interface": "Vlan20", "direction": "out", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan20", "acl": 110, "direction": "out", "misconfig_type": "wildcard", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 110", "no deny tcp 10.0.40.0 0.0.0.63 host 192.0.2.25 eq 8080", "deny tcp 10.0.40.0 0.0.0.255 host 192.0.2.25 eq 8080", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "high", "acl": 100, "interface": "Vlan50", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan50", "acl": 100, "direction": "in", "deny_rate": 1200, "top_source": "10.0.40.0 0.0.0.15", "top_dest": "192.0.2.25", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 100", "deny icmp 10.0.40.0 0.0.0.15 host 192.0.2.25", "exit", "interface Vlan50", "ip access-group 100 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "high", "acl": 101, "interface": "GigabitEthernet0/3", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/3", "acl": 101, "direction": "out", "deny_rate": 500, "top_source": "10.0.20.0 0.0.0.63", "top_dest": "198.51.100.10", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 101", "permit tcp 10.0.20.0 0.0.0.63 host 198.51.100.10 eq 161", "exit", "interface GigabitEthernet0/3", "ip access-group 101 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "medium", "acl": 150, "interface": "Vlan99", "direction": "out", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan99", "acl": 150, "direction": "out", "deny_rate": 500, "top_source": "10.0.10.0 0.0.0.15", "top_dest": "192.0.2.25", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 150", "deny tcp 10.0.10.0 0.0.0.15 host 192.0.2.25", "exit", "interface Vlan99", "ip access-group 150 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "high", "acl": 101, "interface": "GigabitEthernet0/2", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/2", "acl": 101, "direction": "out", "deny_rate": 1200, "top_source": "10.0.30.0 0.0.0.15", "top_dest": "192.0.2.25", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 101", "deny icmp 10.0.30.0 0.0.0.15 host 192.0.2.25", "exit", "interface GigabitEthernet0/2", "ip access-group 101 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "high", "acl": 101, "interface": "Vlan10", "direction": "in", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan10", "acl": 101, "direction": "in", "misconfig_type": "protocol", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 101", "no deny udp 10.0.40.0 0.0.255.255 host 10.0.3.30 eq 80", "deny tcp 10.0.40.0 0.0.255.255 host 10.0.3.30 eq 80", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "critical", "acl": 199, "interface": "Vlan10", "direction": "in", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan10", "acl": 199, "direction": "in", "misconfig_type": "protocol", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 199", "no deny tcp 172.16.10.0 0.0.0.255 host 192.0.2.25 eq 514", "deny udp 172.16.10.0 0.0.0.255 host 192.0.2.25 eq 514", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "medium", "acl": 101, "interface": "Vlan50", "direction": "out", "src": "192.168.1.0 0.0.255.255", "dst": "192.0.2.25", "service": "udp/3389", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan50", "acl": 101, "direction": "out", "deny_hits": 5000, "existing_rules_hint": ["deny udp 192.168.1.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 101", "permit udp 192.168.1.0 0.0.255.255 host 192.0.2.25 eq 3389", "exit", "interface Vlan50", "ip access-group 101 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 199, "interface": "Vlan30", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan30", "acl": 199, "direction": "out", "deny_rate": 1200, "top_source": "172.16.10.0 0.0.255.255", "top_dest": "203.0.113.50", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 199", "deny tcp 172.16.10.0 0.0.255.255 host 203.0.113.50", "exit", "interface Vlan30", "ip access-group 199 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "medium", "acl": 110, "interface": "GigabitEthernet0/1", "direction": "out", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "acl": 110, "direction": "out", "misconfig_type": "protocol", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 110", "no deny udp 10.0.10.0 0.0.0.63 host 10.0.1.10 eq 8080", "deny tcp 10.0.10.0 0.0.0.63 host 10.0.1.10 eq 8080", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 150, "interface": "GigabitEthernet0/2", "direction": "in", "src": "10.0.20.0 0.0.0.63", "dst": "192.0.2.25", "service": "tcp/22", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/2", "acl": 150, "direction": "in", "deny_hits": 500, "existing_rules_hint": ["deny tcp 10.0.20.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 150", "permit tcp 10.0.20.0 0.0.0.63 host 192.0.2.25 eq 22", "exit", "interface GigabitEthernet0/2", "ip access-group 150 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 101, "interface": "Vlan20", "direction": "in", "src": "10.0.30.0 0.0.0.255", "dst": "10.0.3.30", "service": "udp/161", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan20", "acl": 101, "direction": "in", "deny_hits": 5000, "existing_rules_hint": ["deny udp 10.0.30.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 101", "permit udp 10.0.30.0 0.0.0.255 host 10.0.3.30 eq 161", "exit", "interface Vlan20", "ip access-group 101 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "high", "acl": 100, "interface": "GigabitEthernet0/2", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "acl": 100, "direction": "out", "misconfig_type": "direction", "symptom": "unexpected permit"}], "cli_fix": ["interface GigabitEthernet0/2", "no ip access-group 100 in", "no ip access-group 100 out", "ip access-group 100 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 110, "interface": "GigabitEthernet0/2", "direction": "out", "src": "192.168.1.0 0.0.0.15", "dst": "10.0.3.30", "service": "udp/3389", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "acl": 110, "direction": "out", "deny_hits": 200, "existing_rules_hint": ["deny udp 192.168.1.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit udp 192.168.1.0 0.0.0.15 host 10.0.3.30 eq 3389", "exit", "interface GigabitEthernet0/2", "ip access-group 110 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 120, "interface": "Vlan40", "direction": "in", "src": "10.0.10.0 0.0.255.255", "dst": "192.0.2.25", "service": "udp/161", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan40", "acl": 120, "direction": "in", "deny_hits": 1200, "existing_rules_hint": ["deny udp 10.0.10.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 120", "permit udp 10.0.10.0 0.0.255.255 host 192.0.2.25 eq 161", "exit", "interface Vlan40", "ip access-group 120 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "medium", "acl": 100, "interface": "Vlan30", "direction": "out", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan30", "acl": 100, "direction": "out", "misconfig_type": "protocol", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 100", "no deny udp 192.168.1.0 0.0.0.15 host 10.0.2.20 eq 443", "deny tcp 192.168.1.0 0.0.0.15 host 10.0.2.20 eq 443", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "high", "acl": 110, "interface": "GigabitEthernet0/2", "direction": "in", "src": "10.0.30.0 0.0.0.255", "dst": "10.0.3.30", "service": "udp/8080", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "acl": 110, "direction": "in", "deny_hits": 5000, "existing_rules_hint": ["deny udp 10.0.30.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit udp 10.0.30.0 0.0.0.255 host 10.0.3.30 eq 8080", "exit", "interface GigabitEthernet0/2", "ip access-group 110 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "medium", "acl": 150, "interface": "Vlan99", "direction": "out", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan99", "acl": 150, "direction": "out", "misconfig_type": "protocol", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 150", "no deny tcp 10.0.10.0 0.0.0.255 host 10.0.1.10 eq 22", "deny udp 10.0.10.0 0.0.0.255 host 10.0.1.10 eq 22", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 110, "interface": "Vlan10", "direction": "out", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan10", "acl": 110, "direction": "out", "deny_rate": 500, "top_source": "192.168.1.0 0.0.255.255", "top_dest": "198.51.100.10", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 110", "deny udp 192.168.1.0 0.0.255.255 host 198.51.100.10", "exit", "interface Vlan10", "ip access-group 110 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "high", "acl": 120, "interface": "Vlan20", "direction": "out", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan20", "acl": 120, "direction": "out", "deny_rate": 1200, "top_source": "10.0.40.0 0.0.255.255", "top_dest": "10.0.3.30", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 120", "permit tcp 10.0.40.0 0.0.255.255 host 10.0.3.30 eq 23", "exit", "interface Vlan20", "ip access-group 120 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 199, "interface": "GigabitEthernet0/1", "direction": "out", "src": "10.0.30.0 0.0.0.63", "dst": "203.0.113.50", "service": "udp/514", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "acl": 199, "direction": "out", "deny_hits": 200, "existing_rules_hint": ["deny udp 10.0.30.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit udp 10.0.30.0 0.0.0.63 host 203.0.113.50 eq 514", "exit", "interface GigabitEthernet0/1", "ip access-group 199 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "medium", "acl": 199, "interface": "GigabitEthernet0/0", "direction": "out", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/0", "acl": 199, "direction": "out", "misconfig_type": "wildcard", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 199", "no deny udp 10.0.40.0 0.0.0.255 host 10.0.2.20 eq 22", "deny udp 10.0.40.0 0.0.0.63 host 10.0.2.20 eq 22", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 150, "interface": "GigabitEthernet0/1", "direction": "in", "src": "10.0.10.0 0.0.255.255", "dst": "10.0.3.30", "service": "udp/22", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "acl": 150, "direction": "in", "deny_hits": 5000, "existing_rules_hint": ["deny udp 10.0.10.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 150", "permit udp 10.0.10.0 0.0.255.255 host 10.0.3.30 eq 22", "exit", "interface GigabitEthernet0/1", "ip access-group 150 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 150, "interface": "Vlan10", "direction": "in", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan10", "acl": 150, "direction": "in", "deny_rate": 1200, "top_source": "10.0.40.0 0.0.255.255", "top_dest": "203.0.113.50", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 150", "deny icmp 10.0.40.0 0.0.255.255 host 203.0.113.50", "exit", "interface Vlan10", "ip access-group 150 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 120, "interface": "GigabitEthernet0/3", "direction": "out", "src": "10.0.10.0 0.0.0.63", "dst": "10.0.1.10", "service": "tcp/3389", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "acl": 120, "direction": "out", "deny_hits": 500, "existing_rules_hint": ["deny tcp 10.0.10.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 120", "permit tcp 10.0.10.0 0.0.0.63 host 10.0.1.10 eq 3389", "exit", "interface GigabitEthernet0/3", "ip access-group 120 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "high", "acl": 110, "interface": "GigabitEthernet0/0", "direction": "in", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "acl": 110, "direction": "in", "deny_rate": 5000, "top_source": "10.0.30.0 0.0.0.255", "top_dest": "10.0.2.20", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 110", "permit tcp 10.0.30.0 0.0.0.255 host 10.0.2.20 eq 22", "exit", "interface GigabitEthernet0/0", "ip access-group 110 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "medium", "acl": 120, "interface": "Vlan10", "direction": "out", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan10", "acl": 120, "direction": "out", "misconfig_type": "wildcard", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 120", "no deny udp 10.0.10.0 0.0.0.63 host 192.0.2.25 eq 161", "deny udp 10.0.10.0 0.0.0.255 host 192.0.2.25 eq 161", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "high", "acl": 100, "interface": "Vlan40", "direction": "out", "src": "10.0.30.0 0.0.0.15", "dst": "198.51.100.10", "service": "udp/22", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan40", "acl": 100, "direction": "out", "deny_hits": 500, "existing_rules_hint": ["deny udp 10.0.30.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 100", "permit udp 10.0.30.0 0.0.0.15 host 198.51.100.10 eq 22", "exit", "interface Vlan40", "ip access-group 100 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "medium", "acl": 110, "interface": "GigabitEthernet0/1", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "acl": 110, "direction": "in", "deny_rate": 500, "top_source": "10.0.30.0 0.0.0.255", "top_dest": "10.0.2.20", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 110", "deny icmp 10.0.30.0 0.0.0.255 host 10.0.2.20", "exit", "interface GigabitEthernet0/1", "ip access-group 110 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 110, "interface": "Vlan50", "direction": "out", "src": "10.0.30.0 0.0.0.255", "dst": "203.0.113.50", "service": "tcp/22", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan50", "acl": 110, "direction": "out", "deny_hits": 200, "existing_rules_hint": ["deny tcp 10.0.30.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit tcp 10.0.30.0 0.0.0.255 host 203.0.113.50 eq 22", "exit", "interface Vlan50", "ip access-group 110 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "medium", "acl": 101, "interface": "Vlan20", "direction": "in", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan20", "acl": 101, "direction": "in", "misconfig_type": "protocol", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 101", "no deny tcp 10.0.40.0 0.0.0.255 host 203.0.113.50 eq 443", "deny udp 10.0.40.0 0.0.0.255 host 203.0.113.50 eq 443", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "medium", "acl": 110, "interface": "GigabitEthernet0/2", "direction": "in", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "acl": 110, "direction": "in", "misconfig_type": "direction", "symptom": "unexpected permit"}], "cli_fix": ["interface GigabitEthernet0/2", "no ip access-group 110 in", "no ip access-group 110 out", "ip access-group 110 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "high", "acl": 100, "interface": "Vlan10", "direction": "in", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan10", "acl": 100, "direction": "in", "deny_rate": 1200, "top_source": "10.0.40.0 0.0.0.63", "top_dest": "198.51.100.10", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 100", "permit tcp 10.0.40.0 0.0.0.63 host 198.51.100.10 eq 8080", "exit", "interface Vlan10", "ip access-group 100 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "high", "acl": 101, "interface": "Vlan10", "direction": "in", "src": "10.0.40.0 0.0.255.255", "dst": "198.51.100.10", "service": "tcp/443", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan10", "acl": 101, "direction": "in", "deny_hits": 200, "existing_rules_hint": ["deny tcp 10.0.40.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 101", "permit tcp 10.0.40.0 0.0.255.255 host 198.51.100.10 eq 443", "exit", "interface Vlan10", "ip access-group 101 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "medium", "acl": 100, "interface": "Vlan99", "direction": "in", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan99", "acl": 100, "direction": "in", "deny_rate": 500, "top_source": "10.0.40.0 0.0.0.255", "top_dest": "192.0.2.25", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 100", "deny udp 10.0.40.0 0.0.0.255 host 192.0.2.25", "exit", "interface Vlan99", "ip access-group 100 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "medium", "acl": 110, "interface": "Vlan30", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan30", "acl": 110, "direction": "out", "misconfig_type": "direction", "symptom": "unexpected permit"}], "cli_fix": ["interface Vlan30", "no ip access-group 110 in", "no ip access-group 110 out", "ip access-group 110 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "high", "acl": 100, "interface": "Vlan40", "direction": "in", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan40", "acl": 100, "direction": "in", "deny_rate": 200, "top_source": "172.16.10.0 0.0.0.255", "top_dest": "10.0.2.20", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 100", "deny tcp 172.16.10.0 0.0.0.255 host 10.0.2.20", "exit", "interface Vlan40", "ip access-group 100 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "medium", "acl": 199, "interface": "Vlan20", "direction": "in", "src": "172.16.10.0 0.0.0.15", "dst": "198.51.100.10", "service": "tcp/123", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan20", "acl": 199, "direction": "in", "deny_hits": 200, "existing_rules_hint": ["deny tcp 172.16.10.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit tcp 172.16.10.0 0.0.0.15 host 198.51.100.10 eq 123", "exit", "interface Vlan20", "ip access-group 199 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 100, "interface": "GigabitEthernet0/1", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "acl": 100, "direction": "out", "deny_rate": 500, "top_source": "10.0.10.0 0.0.0.63", "top_dest": "10.0.1.10", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 100", "permit tcp 10.0.10.0 0.0.0.63 host 10.0.1.10 eq 23", "exit", "interface GigabitEthernet0/1", "ip access-group 100 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "critical", "acl": 100, "interface": "Vlan30", "direction": "in", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan30", "acl": 100, "direction": "in", "misconfig_type": "wildcard", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 100", "no deny tcp 10.0.30.0 0.0.0.15 host 192.0.2.25 eq 3389", "deny tcp 10.0.30.0 0.0.0.255 host 192.0.2.25 eq 3389", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "medium", "acl": 110, "interface": "GigabitEthernet0/2", "direction": "out", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/2", "acl": 110, "direction": "out", "misconfig_type": "protocol", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 110", "no deny udp 10.0.10.0 0.0.0.63 host 10.0.3.30 eq 22", "deny tcp 10.0.10.0 0.0.0.63 host 10.0.3.30 eq 22", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "high", "acl": 199, "interface": "GigabitEthernet0/1", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "acl": 199, "direction": "in", "deny_rate": 5000, "top_source": "10.0.20.0 0.0.0.63", "top_dest": "203.0.113.50", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 199", "permit tcp 10.0.20.0 0.0.0.63 host 203.0.113.50 eq 22", "exit", "interface GigabitEthernet0/1", "ip access-group 199 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "high", "acl": 199, "interface": "Vlan99", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan99", "acl": 199, "direction": "in", "deny_rate": 200, "top_source": "10.0.30.0 0.0.0.15", "top_dest": "10.0.2.20", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 199", "deny tcp 10.0.30.0 0.0.0.15 host 10.0.2.20", "exit", "interface Vlan99", "ip access-group 199 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 110, "interface": "Vlan99", "direction": "in", "src": "10.0.20.0 0.0.0.15", "dst": "10.0.3.30", "service": "tcp/80", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan99", "acl": 110, "direction": "in", "deny_hits": 200, "existing_rules_hint": ["deny tcp 10.0.20.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit tcp 10.0.20.0 0.0.0.15 host 10.0.3.30 eq 80", "exit", "interface Vlan99", "ip access-group 110 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 150, "interface": "GigabitEthernet0/0", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "acl": 150, "direction": "out", "deny_rate": 500, "top_source": "192.168.1.0 0.0.0.15", "top_dest": "10.0.2.20", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 150", "deny tcp 192.168.1.0 0.0.0.15 host 10.0.2.20", "exit", "interface GigabitEthernet0/0", "ip access-group 150 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "medium", "acl": 120, "interface": "GigabitEthernet0/2", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/2", "acl": 120, "direction": "out", "misconfig_type": "direction", "symptom": "policy not applied"}], "cli_fix": ["interface GigabitEthernet0/2", "no ip access-group 120 in", "no ip access-group 120 out", "ip access-group 120 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "medium", "acl": 110, "interface": "GigabitEthernet0/2", "direction": "in", "src": "10.0.10.0 0.0.0.63", "dst": "10.0.1.10", "service": "udp/80", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/2", "acl": 110, "direction": "in", "deny_hits": 1200, "existing_rules_hint": ["deny udp 10.0.10.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit udp 10.0.10.0 0.0.0.63 host 10.0.1.10 eq 80", "exit", "interface GigabitEthernet0/2", "ip access-group 110 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "critical", "acl": 100, "interface": "GigabitEthernet0/3", "direction": "in", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/3", "acl": 100, "direction": "in", "misconfig_type": "wildcard", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 100", "no deny tcp 10.0.30.0 0.0.0.15 host 198.51.100.10 eq 80", "deny tcp 10.0.30.0 0.0.255.255 host 198.51.100.10 eq 80", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "high", "acl": 199, "interface": "GigabitEthernet0/2", "direction": "in", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/2", "acl": 199, "direction": "in", "deny_rate": 200, "top_source": "10.0.20.0 0.0.0.63", "top_dest": "198.51.100.10", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 199", "permit tcp 10.0.20.0 0.0.0.63 host 198.51.100.10 eq 161", "exit", "interface GigabitEthernet0/2", "ip access-group 199 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 110, "interface": "Vlan30", "direction": "in", "src": "172.16.10.0 0.0.0.63", "dst": "10.0.3.30", "service": "udp/80", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan30", "acl": 110, "direction": "in", "deny_hits": 500, "existing_rules_hint": ["deny udp 172.16.10.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit udp 172.16.10.0 0.0.0.63 host 10.0.3.30 eq 80", "exit", "interface Vlan30", "ip access-group 110 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "critical", "acl": 100, "interface": "GigabitEthernet0/2", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "acl": 100, "direction": "out", "misconfig_type": "direction", "symptom": "unexpected permit"}], "cli_fix": ["interface GigabitEthernet0/2", "no ip access-group 100 in", "no ip access-group 100 out", "ip access-group 100 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "high", "acl": 101, "interface": "Vlan10", "direction": "in", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan10", "acl": 101, "direction": "in", "misconfig_type": "wildcard", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 101", "no deny udp 172.16.10.0 0.0.0.63 host 10.0.2.20 eq 22", "deny udp 172.16.10.0 0.0.255.255 host 10.0.2.20 eq 22", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "high", "acl": 150, "interface": "Vlan99", "direction": "out", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan99", "acl": 150, "direction": "out", "deny_rate": 1200, "top_source": "10.0.30.0 0.0.0.15", "top_dest": "198.51.100.10", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 150", "deny tcp 10.0.30.0 0.0.0.15 host 198.51.100.10", "exit", "interface Vlan99", "ip access-group 150 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "medium", "acl": 150, "interface": "GigabitEthernet0/2", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "acl": 150, "direction": "in", "deny_rate": 200, "top_source": "10.0.30.0 0.0.0.63", "top_dest": "203.0.113.50", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 150", "deny icmp 10.0.30.0 0.0.0.63 host 203.0.113.50", "exit", "interface GigabitEthernet0/2", "ip access-group 150 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "medium", "acl": 150, "interface": "Vlan10", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan10", "acl": 150, "direction": "out", "misconfig_type": "direction", "symptom": "unexpected deny"}], "cli_fix": ["interface Vlan10", "no ip access-group 150 in", "no ip access-group 150 out", "ip access-group 150 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 120, "interface": "GigabitEthernet0/1", "direction": "in", "src": "192.168.1.0 0.0.255.255", "dst": "10.0.2.20", "service": "udp/3389", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "acl": 120, "direction": "in", "deny_hits": 200, "existing_rules_hint": ["deny udp 192.168.1.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 120", "permit udp 192.168.1.0 0.0.255.255 host 10.0.2.20 eq 3389", "exit", "interface GigabitEthernet0/1", "ip access-group 120 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "high", "acl": 100, "interface": "GigabitEthernet0/2", "direction": "in", "src": "10.0.30.0 0.0.255.255", "dst": "10.0.3.30", "service": "tcp/23", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/2", "acl": 100, "direction": "in", "deny_hits": 500, "existing_rules_hint": ["deny tcp 10.0.30.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 100", "permit tcp 10.0.30.0 0.0.255.255 host 10.0.3.30 eq 23", "exit", "interface GigabitEthernet0/2", "ip access-group 100 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "critical", "acl": 100, "interface": "Vlan20", "direction": "in", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan20", "acl": 100, "direction": "in", "misconfig_type": "direction", "symptom": "unexpected deny"}], "cli_fix": ["interface Vlan20", "no ip access-group 100 in", "no ip access-group 100 out", "ip access-group 100 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "medium", "acl": 101, "interface": "Vlan10", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan10", "acl": 101, "direction": "out", "deny_rate": 500, "top_source": "172.16.10.0 0.0.255.255", "top_dest": "10.0.3.30", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 101", "permit tcp 172.16.10.0 0.0.255.255 host 10.0.3.30 eq 8080", "exit", "interface Vlan10", "ip access-group 101 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "medium", "acl": 199, "interface": "GigabitEthernet0/1", "direction": "out", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "acl": 199, "direction": "out", "deny_rate": 5000, "top_source": "172.16.10.0 0.0.0.63", "top_dest": "198.51.100.10", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 199", "deny tcp 172.16.10.0 0.0.0.63 host 198.51.100.10", "exit", "interface GigabitEthernet0/1", "ip access-group 199 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "critical", "acl": 150, "interface": "Vlan40", "direction": "in", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan40", "acl": 150, "direction": "in", "misconfig_type": "direction", "symptom": "unexpected deny"}], "cli_fix": ["interface Vlan40", "no ip access-group 150 in", "no ip access-group 150 out", "ip access-group 150 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "high", "acl": 150, "interface": "Vlan30", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan30", "acl": 150, "direction": "out", "misconfig_type": "direction", "symptom": "unexpected deny"}], "cli_fix": ["interface Vlan30", "no ip access-group 150 in", "no ip access-group 150 out", "ip access-group 150 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "high", "acl": 110, "interface": "GigabitEthernet0/0", "direction": "in", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "acl": 110, "direction": "in", "deny_rate": 200, "top_source": "10.0.40.0 0.0.0.255", "top_dest": "203.0.113.50", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 110", "permit tcp 10.0.40.0 0.0.0.255 host 203.0.113.50 eq 514", "exit", "interface GigabitEthernet0/0", "ip access-group 110 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 199, "interface": "Vlan20", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan20", "acl": 199, "direction": "in", "deny_rate": 1200, "top_source": "172.16.10.0 0.0.0.63", "top_dest": "10.0.3.30", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 199", "deny udp 172.16.10.0 0.0.0.63 host 10.0.3.30", "exit", "interface Vlan20", "ip access-group 199 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 199, "interface": "GigabitEthernet0/1", "direction": "in", "src": "172.16.10.0 0.0.0.15", "dst": "203.0.113.50", "service": "tcp/443", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "acl": 199, "direction": "in", "deny_hits": 200, "existing_rules_hint": ["deny tcp 172.16.10.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit tcp 172.16.10.0 0.0.0.15 host 203.0.113.50 eq 443", "exit", "interface GigabitEthernet0/1", "ip access-group 199 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "medium", "acl": 199, "interface": "Vlan30", "direction": "in", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan30", "acl": 199, "direction": "in", "misconfig_type": "protocol", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 199", "no deny tcp 10.0.20.0 0.0.0.63 host 198.51.100.10 eq 80", "deny udp 10.0.20.0 0.0.0.63 host 198.51.100.10 eq 80", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 101, "interface": "Vlan10", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan10", "acl": 101, "direction": "out", "deny_rate": 5000, "top_source": "10.0.20.0 0.0.0.63", "top_dest": "203.0.113.50", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 101", "deny udp 10.0.20.0 0.0.0.63 host 203.0.113.50", "exit", "interface Vlan10", "ip access-group 101 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "high", "acl": 150, "interface": "Vlan30", "direction": "out", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan30", "acl": 150, "direction": "out", "deny_rate": 5000, "top_source": "10.0.10.0 0.0.0.15", "top_dest": "10.0.2.20", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 150", "deny tcp 10.0.10.0 0.0.0.15 host 10.0.2.20", "exit", "interface Vlan30", "ip access-group 150 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "medium", "acl": 199, "interface": "Vlan10", "direction": "out", "src": "192.168.1.0 0.0.0.15", "dst": "192.0.2.25", "service": "tcp/53", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan10", "acl": 199, "direction": "out", "deny_hits": 500, "existing_rules_hint": ["deny tcp 192.168.1.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit tcp 192.168.1.0 0.0.0.15 host 192.0.2.25 eq 53", "exit", "interface Vlan10", "ip access-group 199 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "critical", "acl": 199, "interface": "GigabitEthernet0/0", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "acl": 199, "direction": "out", "misconfig_type": "direction", "symptom": "policy not applied"}], "cli_fix": ["interface GigabitEthernet0/0", "no ip access-group 199 in", "no ip access-group 199 out", "ip access-group 199 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 199, "interface": "GigabitEthernet0/1", "direction": "out", "src": "10.0.30.0 0.0.0.63", "dst": "203.0.113.50", "service": "tcp/443", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "acl": 199, "direction": "out", "deny_hits": 5000, "existing_rules_hint": ["deny tcp 10.0.30.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit tcp 10.0.30.0 0.0.0.63 host 203.0.113.50 eq 443", "exit", "interface GigabitEthernet0/1", "ip access-group 199 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "high", "acl": 199, "interface": "Vlan30", "direction": "out", "src": "172.16.10.0 0.0.0.63", "dst": "10.0.1.10", "service": "tcp/8080", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan30", "acl": 199, "direction": "out", "deny_hits": 1200, "existing_rules_hint": ["deny tcp 172.16.10.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit tcp 172.16.10.0 0.0.0.63 host 10.0.1.10 eq 8080", "exit", "interface Vlan30", "ip access-group 199 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "high", "acl": 150, "interface": "Vlan10", "direction": "out", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan10", "acl": 150, "direction": "out", "deny_rate": 200, "top_source": "10.0.20.0 0.0.0.63", "top_dest": "203.0.113.50", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 150", "deny udp 10.0.20.0 0.0.0.63 host 203.0.113.50", "exit", "interface Vlan10", "ip access-group 150 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 120, "interface": "GigabitEthernet0/2", "direction": "in", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/2", "acl": 120, "direction": "in", "deny_rate": 200, "top_source": "10.0.20.0 0.0.0.63", "top_dest": "198.51.100.10", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 120", "permit tcp 10.0.20.0 0.0.0.63 host 198.51.100.10 eq 80", "exit", "interface GigabitEthernet0/2", "ip access-group 120 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "high", "acl": 150, "interface": "GigabitEthernet0/3", "direction": "in", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/3", "acl": 150, "direction": "in", "misconfig_type": "protocol", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 150", "no deny udp 10.0.30.0 0.0.0.63 host 10.0.1.10 eq 80", "deny tcp 10.0.30.0 0.0.0.63 host 10.0.1.10 eq 80", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "high", "acl": 100, "interface": "Vlan10", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan10", "acl": 100, "direction": "out", "deny_rate": 5000, "top_source": "192.168.1.0 0.0.0.15", "top_dest": "10.0.2.20", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 100", "permit tcp 192.168.1.0 0.0.0.15 host 10.0.2.20 eq 161", "exit", "interface Vlan10", "ip access-group 100 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "critical", "acl": 150, "interface": "GigabitEthernet0/3", "direction": "in", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/3", "acl": 150, "direction": "in", "misconfig_type": "protocol", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 150", "no deny udp 172.16.10.0 0.0.0.63 host 10.0.1.10 eq 3389", "deny tcp 172.16.10.0 0.0.0.63 host 10.0.1.10 eq 3389", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 150, "interface": "Vlan30", "direction": "out", "src": "10.0.40.0 0.0.255.255", "dst": "192.0.2.25", "service": "tcp/22", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan30", "acl": 150, "direction": "out", "deny_hits": 500, "existing_rules_hint": ["deny tcp 10.0.40.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 150", "permit tcp 10.0.40.0 0.0.255.255 host 192.0.2.25 eq 22", "exit", "interface Vlan30", "ip access-group 150 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 100, "interface": "Vlan50", "direction": "in", "src": "10.0.10.0 0.0.0.255", "dst": "10.0.2.20", "service": "udp/80", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan50", "acl": 100, "direction": "in", "deny_hits": 5000, "existing_rules_hint": ["deny udp 10.0.10.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 100", "permit udp 10.0.10.0 0.0.0.255 host 10.0.2.20 eq 80", "exit", "interface Vlan50", "ip access-group 100 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "medium", "acl": 101, "interface": "Vlan10", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan10", "acl": 101, "direction": "out", "misconfig_type": "direction", "symptom": "unexpected permit"}], "cli_fix": ["interface Vlan10", "no ip access-group 101 in", "no ip access-group 101 out", "ip access-group 101 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "critical", "acl": 101, "interface": "GigabitEthernet0/2", "direction": "in", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/2", "acl": 101, "direction": "in", "misconfig_type": "protocol", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 101", "no deny udp 10.0.10.0 0.0.0.63 host 10.0.3.30 eq 8080", "deny tcp 10.0.10.0 0.0.0.63 host 10.0.3.30 eq 8080", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "high", "acl": 150, "interface": "Vlan20", "direction": "out", "src": "10.0.20.0 0.0.0.255", "dst": "10.0.3.30", "service": "udp/3389", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan20", "acl": 150, "direction": "out", "deny_hits": 200, "existing_rules_hint": ["deny udp 10.0.20.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 150", "permit udp 10.0.20.0 0.0.0.255 host 10.0.3.30 eq 3389", "exit", "interface Vlan20", "ip access-group 150 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 101, "interface": "GigabitEthernet0/2", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "acl": 101, "direction": "in", "deny_rate": 1200, "top_source": "10.0.20.0 0.0.255.255", "top_dest": "10.0.2.20", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 101", "permit tcp 10.0.20.0 0.0.255.255 host 10.0.2.20 eq 53", "exit", "interface GigabitEthernet0/2", "ip access-group 101 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "critical", "acl": 100, "interface": "Vlan30", "direction": "out", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan30", "acl": 100, "direction": "out", "misconfig_type": "protocol", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 100", "no deny udp 192.168.1.0 0.0.255.255 host 10.0.2.20 eq 123", "deny tcp 192.168.1.0 0.0.255.255 host 10.0.2.20 eq 123", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 101, "interface": "Vlan50", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan50", "acl": 101, "direction": "out", "deny_rate": 1200, "top_source": "192.168.1.0 0.0.0.63", "top_dest": "10.0.2.20", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 101", "permit tcp 192.168.1.0 0.0.0.63 host 10.0.2.20 eq 22", "exit", "interface Vlan50", "ip access-group 101 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 100, "interface": "GigabitEthernet0/0", "direction": "out", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "acl": 100, "direction": "out", "deny_rate": 500, "top_source": "10.0.10.0 0.0.0.15", "top_dest": "198.51.100.10", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 100", "permit tcp 10.0.10.0 0.0.0.15 host 198.51.100.10 eq 53", "exit", "interface GigabitEthernet0/0", "ip access-group 100 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "high", "acl": 150, "interface": "GigabitEthernet0/1", "direction": "out", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "acl": 150, "direction": "out", "deny_rate": 500, "top_source": "10.0.30.0 0.0.0.255", "top_dest": "192.0.2.25", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 150", "permit tcp 10.0.30.0 0.0.0.255 host 192.0.2.25 eq 80", "exit", "interface GigabitEthernet0/1", "ip access-group 150 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 199, "interface": "GigabitEthernet0/3", "direction": "out", "src": "10.0.10.0 0.0.255.255", "dst": "10.0.3.30", "service": "tcp/8080", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "acl": 199, "direction": "out", "deny_hits": 1200, "existing_rules_hint": ["deny tcp 10.0.10.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit tcp 10.0.10.0 0.0.255.255 host 10.0.3.30 eq 8080", "exit", "interface GigabitEthernet0/3", "ip access-group 199 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "high", "acl": 110, "interface": "Vlan20", "direction": "out", "src": "192.168.1.0 0.0.0.15", "dst": "203.0.113.50", "service": "udp/3389", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan20", "acl": 110, "direction": "out", "deny_hits": 1200, "existing_rules_hint": ["deny udp 192.168.1.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit udp 192.168.1.0 0.0.0.15 host 203.0.113.50 eq 3389", "exit", "interface Vlan20", "ip access-group 110 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 199, "interface": "Vlan30", "direction": "in", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan30", "acl": 199, "direction": "in", "deny_rate": 1200, "top_source": "172.16.10.0 0.0.0.255", "top_dest": "10.0.1.10", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 199", "deny udp 172.16.10.0 0.0.0.255 host 10.0.1.10", "exit", "interface Vlan30", "ip access-group 199 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "medium", "acl": 110, "interface": "GigabitEthernet0/3", "direction": "out", "src": "192.168.1.0 0.0.0.15", "dst": "198.51.100.10", "service": "udp/161", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "acl": 110, "direction": "out", "deny_hits": 5000, "existing_rules_hint": ["deny udp 192.168.1.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit udp 192.168.1.0 0.0.0.15 host 198.51.100.10 eq 161", "exit", "interface GigabitEthernet0/3", "ip access-group 110 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 150, "interface": "Vlan50", "direction": "out", "src": "192.168.1.0 0.0.0.255", "dst": "10.0.2.20", "service": "udp/22", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan50", "acl": 150, "direction": "out", "deny_hits": 500, "existing_rules_hint": ["deny udp 192.168.1.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 150", "permit udp 192.168.1.0 0.0.0.255 host 10.0.2.20 eq 22", "exit", "interface Vlan50", "ip access-group 150 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 120, "interface": "Vlan30", "direction": "out", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan30", "acl": 120, "direction": "out", "deny_rate": 500, "top_source": "10.0.40.0 0.0.0.255", "top_dest": "10.0.2.20", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 120", "permit tcp 10.0.40.0 0.0.0.255 host 10.0.2.20 eq 53", "exit", "interface Vlan30", "ip access-group 120 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "medium", "acl": 101, "interface": "GigabitEthernet0/0", "direction": "in", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "acl": 101, "direction": "in", "misconfig_type": "wildcard", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 101", "no deny tcp 10.0.10.0 0.0.0.63 host 10.0.2.20 eq 53", "deny tcp 10.0.10.0 0.0.0.255 host 10.0.2.20 eq 53", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "medium", "acl": 150, "interface": "Vlan50", "direction": "in", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan50", "acl": 150, "direction": "in", "deny_rate": 500, "top_source": "10.0.40.0 0.0.0.63", "top_dest": "192.0.2.25", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 150", "permit tcp 10.0.40.0 0.0.0.63 host 192.0.2.25 eq 22", "exit", "interface Vlan50", "ip access-group 150 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "medium", "acl": 100, "interface": "Vlan20", "direction": "in", "src": "10.0.30.0 0.0.0.63", "dst": "10.0.2.20", "service": "tcp/514", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan20", "acl": 100, "direction": "in", "deny_hits": 1200, "existing_rules_hint": ["deny tcp 10.0.30.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 100", "permit tcp 10.0.30.0 0.0.0.63 host 10.0.2.20 eq 514", "exit", "interface Vlan20", "ip access-group 100 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 100, "interface": "Vlan40", "direction": "out", "src": "10.0.40.0 0.0.0.15", "dst": "10.0.3.30", "service": "udp/443", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan40", "acl": 100, "direction": "out", "deny_hits": 200, "existing_rules_hint": ["deny udp 10.0.40.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 100", "permit udp 10.0.40.0 0.0.0.15 host 10.0.3.30 eq 443", "exit", "interface Vlan40", "ip access-group 100 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "high", "acl": 150, "interface": "Vlan40", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan40", "acl": 150, "direction": "in", "deny_rate": 5000, "top_source": "10.0.30.0 0.0.0.255", "top_dest": "192.0.2.25", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 150", "deny udp 10.0.30.0 0.0.0.255 host 192.0.2.25", "exit", "interface Vlan40", "ip access-group 150 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "high", "acl": 150, "interface": "Vlan10", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan10", "acl": 150, "direction": "out", "misconfig_type": "direction", "symptom": "unexpected deny"}], "cli_fix": ["interface Vlan10", "no ip access-group 150 in", "no ip access-group 150 out", "ip access-group 150 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "medium", "acl": 110, "interface": "GigabitEthernet0/3", "direction": "in", "src": "10.0.20.0 0.0.0.15", "dst": "198.51.100.10", "service": "tcp/8080", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/3", "acl": 110, "direction": "in", "deny_hits": 200, "existing_rules_hint": ["deny tcp 10.0.20.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit tcp 10.0.20.0 0.0.0.15 host 198.51.100.10 eq 8080", "exit", "interface GigabitEthernet0/3", "ip access-group 110 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "medium", "acl": 199, "interface": "Vlan99", "direction": "out", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan99", "acl": 199, "direction": "out", "deny_rate": 200, "top_source": "10.0.10.0 0.0.0.255", "top_dest": "192.0.2.25", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 199", "deny icmp 10.0.10.0 0.0.0.255 host 192.0.2.25", "exit", "interface Vlan99", "ip access-group 199 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "high", "acl": 101, "interface": "GigabitEthernet0/1", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "acl": 101, "direction": "out", "deny_rate": 1200, "top_source": "10.0.40.0 0.0.255.255", "top_dest": "198.51.100.10", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 101", "permit tcp 10.0.40.0 0.0.255.255 host 198.51.100.10 eq 8080", "exit", "interface GigabitEthernet0/1", "ip access-group 101 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "high", "acl": 100, "interface": "GigabitEthernet0/3", "direction": "out", "src": "192.168.1.0 0.0.0.15", "dst": "198.51.100.10", "service": "udp/80", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "acl": 100, "direction": "out", "deny_hits": 5000, "existing_rules_hint": ["deny udp 192.168.1.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 100", "permit udp 192.168.1.0 0.0.0.15 host 198.51.100.10 eq 80", "exit", "interface GigabitEthernet0/3", "ip access-group 100 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "high", "acl": 110, "interface": "GigabitEthernet0/3", "direction": "out", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "acl": 110, "direction": "out", "deny_rate": 1200, "top_source": "172.16.10.0 0.0.0.63", "top_dest": "203.0.113.50", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 110", "permit tcp 172.16.10.0 0.0.0.63 host 203.0.113.50 eq 3389", "exit", "interface GigabitEthernet0/3", "ip access-group 110 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "high", "acl": 199, "interface": "GigabitEthernet0/1", "direction": "in", "src": "172.16.10.0 0.0.0.63", "dst": "192.0.2.25", "service": "tcp/53", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "acl": 199, "direction": "in", "deny_hits": 5000, "existing_rules_hint": ["deny tcp 172.16.10.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit tcp 172.16.10.0 0.0.0.63 host 192.0.2.25 eq 53", "exit", "interface GigabitEthernet0/1", "ip access-group 199 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "medium", "acl": 101, "interface": "Vlan99", "direction": "in", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan99", "acl": 101, "direction": "in", "misconfig_type": "direction", "symptom": "unexpected permit"}], "cli_fix": ["interface Vlan99", "no ip access-group 101 in", "no ip access-group 101 out", "ip access-group 101 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "medium", "acl": 101, "interface": "GigabitEthernet0/0", "direction": "in", "src": "10.0.40.0 0.0.0.255", "dst": "203.0.113.50", "service": "tcp/23", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "acl": 101, "direction": "in", "deny_hits": 1200, "existing_rules_hint": ["deny tcp 10.0.40.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 101", "permit tcp 10.0.40.0 0.0.0.255 host 203.0.113.50 eq 23", "exit", "interface GigabitEthernet0/0", "ip access-group 101 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 150, "interface": "Vlan99", "direction": "in", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan99", "acl": 150, "direction": "in", "deny_rate": 5000, "top_source": "192.168.1.0 0.0.0.255", "top_dest": "10.0.3.30", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 150", "deny tcp 192.168.1.0 0.0.0.255 host 10.0.3.30", "exit", "interface Vlan99", "ip access-group 150 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "medium", "acl": 120, "interface": "Vlan50", "direction": "in", "src": "172.16.10.0 0.0.0.255", "dst": "198.51.100.10", "service": "tcp/3389", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan50", "acl": 120, "direction": "in", "deny_hits": 5000, "existing_rules_hint": ["deny tcp 172.16.10.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 120", "permit tcp 172.16.10.0 0.0.0.255 host 198.51.100.10 eq 3389", "exit", "interface Vlan50", "ip access-group 120 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "high", "acl": 199, "interface": "Vlan10", "direction": "in", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan10", "acl": 199, "direction": "in", "deny_rate": 200, "top_source": "192.168.1.0 0.0.255.255", "top_dest": "10.0.2.20", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 199", "deny tcp 192.168.1.0 0.0.255.255 host 10.0.2.20", "exit", "interface Vlan10", "ip access-group 199 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "high", "acl": 101, "interface": "GigabitEthernet0/3", "direction": "in", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/3", "acl": 101, "direction": "in", "misconfig_type": "wildcard", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 101", "no deny udp 192.168.1.0 0.0.0.15 host 10.0.1.10 eq 443", "deny udp 192.168.1.0 0.0.0.255 host 10.0.1.10 eq 443", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "high", "acl": 150, "interface": "Vlan40", "direction": "out", "src": "10.0.30.0 0.0.0.63", "dst": "203.0.113.50", "service": "udp/443", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan40", "acl": 150, "direction": "out", "deny_hits": 5000, "existing_rules_hint": ["deny udp 10.0.30.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 150", "permit udp 10.0.30.0 0.0.0.63 host 203.0.113.50 eq 443", "exit", "interface Vlan40", "ip access-group 150 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "high", "acl": 101, "interface": "GigabitEthernet0/0", "direction": "out", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/0", "acl": 101, "direction": "out", "misconfig_type": "wildcard", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 101", "no deny tcp 10.0.10.0 0.0.0.255 host 10.0.1.10 eq 123", "deny tcp 10.0.10.0 0.0.255.255 host 10.0.1.10 eq 123", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 120, "interface": "GigabitEthernet0/2", "direction": "out", "src": "172.16.10.0 0.0.0.63", "dst": "198.51.100.10", "service": "udp/80", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "acl": 120, "direction": "out", "deny_hits": 500, "existing_rules_hint": ["deny udp 172.16.10.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 120", "permit udp 172.16.10.0 0.0.0.63 host 198.51.100.10 eq 80", "exit", "interface GigabitEthernet0/2", "ip access-group 120 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "medium", "acl": 110, "interface": "GigabitEthernet0/2", "direction": "in", "src": "192.168.1.0 0.0.0.255", "dst": "192.0.2.25", "service": "tcp/8080", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/2", "acl": 110, "direction": "in", "deny_hits": 1200, "existing_rules_hint": ["deny tcp 192.168.1.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit tcp 192.168.1.0 0.0.0.255 host 192.0.2.25 eq 8080", "exit", "interface GigabitEthernet0/2", "ip access-group 110 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 110, "interface": "Vlan30", "direction": "out", "src": "10.0.30.0 0.0.0.63", "dst": "10.0.3.30", "service": "udp/23", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan30", "acl": 110, "direction": "out", "deny_hits": 200, "existing_rules_hint": ["deny udp 10.0.30.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit udp 10.0.30.0 0.0.0.63 host 10.0.3.30 eq 23", "exit", "interface Vlan30", "ip access-group 110 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "high", "acl": 110, "interface": "Vlan20", "direction": "out", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan20", "acl": 110, "direction": "out", "misconfig_type": "protocol", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 110", "no deny udp 10.0.20.0 0.0.0.255 host 10.0.3.30 eq 22", "deny tcp 10.0.20.0 0.0.0.255 host 10.0.3.30 eq 22", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 199, "interface": "GigabitEthernet0/1", "direction": "out", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "acl": 199, "direction": "out", "deny_rate": 200, "top_source": "10.0.10.0 0.0.255.255", "top_dest": "10.0.2.20", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 199", "permit tcp 10.0.10.0 0.0.255.255 host 10.0.2.20 eq 3389", "exit", "interface GigabitEthernet0/1", "ip access-group 199 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "high", "acl": 199, "interface": "Vlan30", "direction": "in", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan30", "acl": 199, "direction": "in", "misconfig_type": "direction", "symptom": "unexpected permit"}], "cli_fix": ["interface Vlan30", "no ip access-group 199 in", "no ip access-group 199 out", "ip access-group 199 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "high", "acl": 150, "interface": "Vlan99", "direction": "in", "src": "10.0.10.0 0.0.0.255", "dst": "198.51.100.10", "service": "tcp/443", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan99", "acl": 150, "direction": "in", "deny_hits": 1200, "existing_rules_hint": ["deny tcp 10.0.10.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 150", "permit tcp 10.0.10.0 0.0.0.255 host 198.51.100.10 eq 443", "exit", "interface Vlan99", "ip access-group 150 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "critical", "acl": 110, "interface": "GigabitEthernet0/1", "direction": "in", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "acl": 110, "direction": "in", "misconfig_type": "protocol", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 110", "no deny udp 172.16.10.0 0.0.0.15 host 203.0.113.50 eq 22", "deny tcp 172.16.10.0 0.0.0.15 host 203.0.113.50 eq 22", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "medium", "acl": 101, "interface": "Vlan99", "direction": "in", "src": "192.168.1.0 0.0.0.15", "dst": "192.0.2.25", "service": "udp/443", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan99", "acl": 101, "direction": "in", "deny_hits": 200, "existing_rules_hint": ["deny udp 192.168.1.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 101", "permit udp 192.168.1.0 0.0.0.15 host 192.0.2.25 eq 443", "exit", "interface Vlan99", "ip access-group 101 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "high", "acl": 100, "interface": "GigabitEthernet0/3", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/3", "acl": 100, "direction": "out", "deny_rate": 5000, "top_source": "10.0.10.0 0.0.0.255", "top_dest": "192.0.2.25", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 100", "permit tcp 10.0.10.0 0.0.0.255 host 192.0.2.25 eq 161", "exit", "interface GigabitEthernet0/3", "ip access-group 100 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "medium", "acl": 110, "interface": "Vlan99", "direction": "out", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan99", "acl": 110, "direction": "out", "misconfig_type": "wildcard", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 110", "no deny udp 10.0.40.0 0.0.0.15 host 10.0.1.10 eq 80", "deny udp 10.0.40.0 0.0.0.63 host 10.0.1.10 eq 80", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "high", "acl": 101, "interface": "Vlan99", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan99", "acl": 101, "direction": "in", "deny_rate": 5000, "top_source": "10.0.30.0 0.0.0.255", "top_dest": "203.0.113.50", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 101", "deny icmp 10.0.30.0 0.0.0.255 host 203.0.113.50", "exit", "interface Vlan99", "ip access-group 101 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 150, "interface": "Vlan30", "direction": "in", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan30", "acl": 150, "direction": "in", "deny_rate": 200, "top_source": "10.0.40.0 0.0.255.255", "top_dest": "198.51.100.10", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 150", "deny icmp 10.0.40.0 0.0.255.255 host 198.51.100.10", "exit", "interface Vlan30", "ip access-group 150 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "medium", "acl": 199, "interface": "Vlan50", "direction": "in", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan50", "acl": 199, "direction": "in", "misconfig_type": "protocol", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 199", "no deny tcp 192.168.1.0 0.0.0.63 host 10.0.3.30 eq 23", "deny udp 192.168.1.0 0.0.0.63 host 10.0.3.30 eq 23", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "critical", "acl": 110, "interface": "Vlan40", "direction": "in", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan40", "acl": 110, "direction": "in", "misconfig_type": "protocol", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 110", "no deny udp 10.0.30.0 0.0.255.255 host 10.0.2.20 eq 22", "deny tcp 10.0.30.0 0.0.255.255 host 10.0.2.20 eq 22", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "high", "acl": 199, "interface": "GigabitEthernet0/2", "direction": "in", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/2", "acl": 199, "direction": "in", "misconfig_type": "direction", "symptom": "unexpected deny"}], "cli_fix": ["interface GigabitEthernet0/2", "no ip access-group 199 in", "no ip access-group 199 out", "ip access-group 199 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 150, "interface": "Vlan99", "direction": "in", "src": "10.0.20.0 0.0.0.255", "dst": "10.0.2.20", "service": "udp/161", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan99", "acl": 150, "direction": "in", "deny_hits": 200, "existing_rules_hint": ["deny udp 10.0.20.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 150", "permit udp 10.0.20.0 0.0.0.255 host 10.0.2.20 eq 161", "exit", "interface Vlan99", "ip access-group 150 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 199, "interface": "Vlan50", "direction": "in", "src": "172.16.10.0 0.0.255.255", "dst": "203.0.113.50", "service": "udp/161", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan50", "acl": 199, "direction": "in", "deny_hits": 1200, "existing_rules_hint": ["deny udp 172.16.10.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit udp 172.16.10.0 0.0.255.255 host 203.0.113.50 eq 161", "exit", "interface Vlan50", "ip access-group 199 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "high", "acl": 150, "interface": "GigabitEthernet0/2", "direction": "in", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "acl": 150, "direction": "in", "misconfig_type": "direction", "symptom": "unexpected permit"}], "cli_fix": ["interface GigabitEthernet0/2", "no ip access-group 150 in", "no ip access-group 150 out", "ip access-group 150 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "high", "acl": 199, "interface": "GigabitEthernet0/0", "direction": "in", "src": "192.168.1.0 0.0.0.255", "dst": "203.0.113.50", "service": "udp/161", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "acl": 199, "direction": "in", "deny_hits": 1200, "existing_rules_hint": ["deny udp 192.168.1.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit udp 192.168.1.0 0.0.0.255 host 203.0.113.50 eq 161", "exit", "interface GigabitEthernet0/0", "ip access-group 199 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "critical", "acl": 120, "interface": "Vlan30", "direction": "out", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan30", "acl": 120, "direction": "out", "misconfig_type": "wildcard", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 120", "no deny tcp 10.0.10.0 0.0.0.15 host 198.51.100.10 eq 3389", "deny tcp 10.0.10.0 0.0.0.63 host 198.51.100.10 eq 3389", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "high", "acl": 120, "interface": "Vlan10", "direction": "in", "src": "10.0.10.0 0.0.0.15", "dst": "10.0.2.20", "service": "udp/443", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan10", "acl": 120, "direction": "in", "deny_hits": 1200, "existing_rules_hint": ["deny udp 10.0.10.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 120", "permit udp 10.0.10.0 0.0.0.15 host 10.0.2.20 eq 443", "exit", "interface Vlan10", "ip access-group 120 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "high", "acl": 110, "interface": "Vlan10", "direction": "in", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan10", "acl": 110, "direction": "in", "deny_rate": 1200, "top_source": "172.16.10.0 0.0.0.255", "top_dest": "203.0.113.50", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 110", "deny icmp 172.16.10.0 0.0.0.255 host 203.0.113.50", "exit", "interface Vlan10", "ip access-group 110 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 150, "interface": "Vlan10", "direction": "out", "src": "192.168.1.0 0.0.255.255", "dst": "10.0.3.30", "service": "tcp/514", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan10", "acl": 150, "direction": "out", "deny_hits": 500, "existing_rules_hint": ["deny tcp 192.168.1.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 150", "permit tcp 192.168.1.0 0.0.255.255 host 10.0.3.30 eq 514", "exit", "interface Vlan10", "ip access-group 150 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "high", "acl": 199, "interface": "GigabitEthernet0/2", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "acl": 199, "direction": "in", "deny_rate": 5000, "top_source": "192.168.1.0 0.0.0.63", "top_dest": "198.51.100.10", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 199", "permit tcp 192.168.1.0 0.0.0.63 host 198.51.100.10 eq 3389", "exit", "interface GigabitEthernet0/2", "ip access-group 199 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "high", "acl": 101, "interface": "GigabitEthernet0/0", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "acl": 101, "direction": "out", "misconfig_type": "direction", "symptom": "unexpected permit"}], "cli_fix": ["interface GigabitEthernet0/0", "no ip access-group 101 in", "no ip access-group 101 out", "ip access-group 101 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "medium", "acl": 100, "interface": "Vlan20", "direction": "out", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan20", "acl": 100, "direction": "out", "misconfig_type": "protocol", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 100", "no deny tcp 10.0.10.0 0.0.0.63 host 10.0.2.20 eq 22", "deny udp 10.0.10.0 0.0.0.63 host 10.0.2.20 eq 22", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "high", "acl": 101, "interface": "GigabitEthernet0/2", "direction": "out", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/2", "acl": 101, "direction": "out", "misconfig_type": "wildcard", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 101", "no deny tcp 10.0.30.0 0.0.0.15 host 192.0.2.25 eq 443", "deny tcp 10.0.30.0 0.0.0.255 host 192.0.2.25 eq 443", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "high", "acl": 101, "interface": "GigabitEthernet0/2", "direction": "in", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "acl": 101, "direction": "in", "deny_rate": 1200, "top_source": "10.0.20.0 0.0.0.63", "top_dest": "192.0.2.25", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 101", "permit tcp 10.0.20.0 0.0.0.63 host 192.0.2.25 eq 23", "exit", "interface GigabitEthernet0/2", "ip access-group 101 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "critical", "acl": 110, "interface": "GigabitEthernet0/0", "direction": "in", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/0", "acl": 110, "direction": "in", "misconfig_type": "wildcard", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 110", "no deny udp 10.0.40.0 0.0.0.255 host 192.0.2.25 eq 3389", "deny udp 10.0.40.0 0.0.0.63 host 192.0.2.25 eq 3389", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "high", "acl": 100, "interface": "Vlan40", "direction": "out", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan40", "acl": 100, "direction": "out", "deny_rate": 1200, "top_source": "10.0.40.0 0.0.0.255", "top_dest": "203.0.113.50", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 100", "deny tcp 10.0.40.0 0.0.0.255 host 203.0.113.50", "exit", "interface Vlan40", "ip access-group 100 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "medium", "acl": 120, "interface": "Vlan20", "direction": "in", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan20", "acl": 120, "direction": "in", "misconfig_type": "protocol", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 120", "no deny udp 10.0.40.0 0.0.255.255 host 10.0.3.30 eq 3389", "deny tcp 10.0.40.0 0.0.255.255 host 10.0.3.30 eq 3389", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "medium", "acl": 110, "interface": "Vlan20", "direction": "out", "src": "10.0.30.0 0.0.0.15", "dst": "10.0.1.10", "service": "udp/123", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan20", "acl": 110, "direction": "out", "deny_hits": 1200, "existing_rules_hint": ["deny udp 10.0.30.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit udp 10.0.30.0 0.0.0.15 host 10.0.1.10 eq 123", "exit", "interface Vlan20", "ip access-group 110 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 101, "interface": "Vlan10", "direction": "in", "src": "10.0.20.0 0.0.0.255", "dst": "10.0.3.30", "service": "udp/3389", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan10", "acl": 101, "direction": "in", "deny_hits": 500, "existing_rules_hint": ["deny udp 10.0.20.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 101", "permit udp 10.0.20.0 0.0.0.255 host 10.0.3.30 eq 3389", "exit", "interface Vlan10", "ip access-group 101 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "medium", "acl": 100, "interface": "GigabitEthernet0/0", "direction": "in", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "acl": 100, "direction": "in", "misconfig_type": "direction", "symptom": "unexpected permit"}], "cli_fix": ["interface GigabitEthernet0/0", "no ip access-group 100 in", "no ip access-group 100 out", "ip access-group 100 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 101, "interface": "Vlan10", "direction": "out", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan10", "acl": 101, "direction": "out", "deny_rate": 200, "top_source": "10.0.10.0 0.0.0.255", "top_dest": "192.0.2.25", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 101", "permit tcp 10.0.10.0 0.0.0.255 host 192.0.2.25 eq 8080", "exit", "interface Vlan10", "ip access-group 101 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "high", "acl": 120, "interface": "Vlan40", "direction": "in", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan40", "acl": 120, "direction": "in", "misconfig_type": "protocol", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 120", "no deny tcp 172.16.10.0 0.0.0.255 host 203.0.113.50 eq 8080", "deny udp 172.16.10.0 0.0.0.255 host 203.0.113.50 eq 8080", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "high", "acl": 100, "interface": "Vlan10", "direction": "in", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan10", "acl": 100, "direction": "in", "misconfig_type": "wildcard", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 100", "no deny udp 172.16.10.0 0.0.255.255 host 198.51.100.10 eq 80", "deny udp 172.16.10.0 0.0.0.63 host 198.51.100.10 eq 80", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "high", "acl": 120, "interface": "Vlan10", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan10", "acl": 120, "direction": "out", "deny_rate": 5000, "top_source": "10.0.20.0 0.0.0.255", "top_dest": "10.0.1.10", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 120", "permit tcp 10.0.20.0 0.0.0.255 host 10.0.1.10 eq 443", "exit", "interface Vlan10", "ip access-group 120 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "critical", "acl": 199, "interface": "Vlan10", "direction": "in", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan10", "acl": 199, "direction": "in", "misconfig_type": "wildcard", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 199", "no deny tcp 10.0.30.0 0.0.0.15 host 10.0.3.30 eq 443", "deny tcp 10.0.30.0 0.0.0.255 host 10.0.3.30 eq 443", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "medium", "acl": 110, "interface": "GigabitEthernet0/1", "direction": "in", "src": "192.168.1.0 0.0.0.255", "dst": "10.0.3.30", "service": "udp/161", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "acl": 110, "direction": "in", "deny_hits": 5000, "existing_rules_hint": ["deny udp 192.168.1.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit udp 192.168.1.0 0.0.0.255 host 10.0.3.30 eq 161", "exit", "interface GigabitEthernet0/1", "ip access-group 110 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "medium", "acl": 199, "interface": "GigabitEthernet0/2", "direction": "out", "src": "10.0.10.0 0.0.255.255", "dst": "198.51.100.10", "service": "udp/443", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "acl": 199, "direction": "out", "deny_hits": 200, "existing_rules_hint": ["deny udp 10.0.10.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit udp 10.0.10.0 0.0.255.255 host 198.51.100.10 eq 443", "exit", "interface GigabitEthernet0/2", "ip access-group 199 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "critical", "acl": 120, "interface": "GigabitEthernet0/2", "direction": "in", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "acl": 120, "direction": "in", "misconfig_type": "wildcard", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 120", "no deny udp 192.168.1.0 0.0.0.15 host 10.0.1.10 eq 3389", "deny udp 192.168.1.0 0.0.0.255 host 10.0.1.10 eq 3389", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "medium", "acl": 101, "interface": "Vlan50", "direction": "out", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan50", "acl": 101, "direction": "out", "deny_rate": 500, "top_source": "10.0.20.0 0.0.255.255", "top_dest": "10.0.3.30", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 101", "permit tcp 10.0.20.0 0.0.255.255 host 10.0.3.30 eq 8080", "exit", "interface Vlan50", "ip access-group 101 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "critical", "acl": 100, "interface": "GigabitEthernet0/2", "direction": "out", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "acl": 100, "direction": "out", "misconfig_type": "wildcard", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 100", "no deny udp 172.16.10.0 0.0.0.63 host 10.0.1.10 eq 3389", "deny udp 172.16.10.0 0.0.0.15 host 10.0.1.10 eq 3389", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 199, "interface": "GigabitEthernet0/1", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "acl": 199, "direction": "in", "deny_rate": 1200, "top_source": "10.0.30.0 0.0.0.15", "top_dest": "198.51.100.10", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 199", "permit tcp 10.0.30.0 0.0.0.15 host 198.51.100.10 eq 161", "exit", "interface GigabitEthernet0/1", "ip access-group 199 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 150, "interface": "Vlan50", "direction": "in", "src": "10.0.30.0 0.0.0.63", "dst": "10.0.2.20", "service": "udp/3389", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan50", "acl": 150, "direction": "in", "deny_hits": 200, "existing_rules_hint": ["deny udp 10.0.30.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 150", "permit udp 10.0.30.0 0.0.0.63 host 10.0.2.20 eq 3389", "exit", "interface Vlan50", "ip access-group 150 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "critical", "acl": 150, "interface": "Vlan20", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan20", "acl": 150, "direction": "out", "misconfig_type": "direction", "symptom": "unexpected permit"}], "cli_fix": ["interface Vlan20", "no ip access-group 150 in", "no ip access-group 150 out", "ip access-group 150 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 120, "interface": "Vlan40", "direction": "out", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan40", "acl": 120, "direction": "out", "deny_rate": 1200, "top_source": "172.16.10.0 0.0.0.255", "top_dest": "203.0.113.50", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 120", "permit tcp 172.16.10.0 0.0.0.255 host 203.0.113.50 eq 3389", "exit", "interface Vlan40", "ip access-group 120 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "critical", "acl": 150, "interface": "Vlan40", "direction": "out", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan40", "acl": 150, "direction": "out", "misconfig_type": "wildcard", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 150", "no deny udp 10.0.20.0 0.0.0.15 host 10.0.1.10 eq 514", "deny udp 10.0.20.0 0.0.0.63 host 10.0.1.10 eq 514", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "medium", "acl": 100, "interface": "GigabitEthernet0/0", "direction": "out", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "acl": 100, "direction": "out", "deny_rate": 5000, "top_source": "192.168.1.0 0.0.0.255", "top_dest": "203.0.113.50", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 100", "permit tcp 192.168.1.0 0.0.0.255 host 203.0.113.50 eq 8080", "exit", "interface GigabitEthernet0/0", "ip access-group 100 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "high", "acl": 100, "interface": "Vlan10", "direction": "in", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan10", "acl": 100, "direction": "in", "deny_rate": 500, "top_source": "172.16.10.0 0.0.0.63", "top_dest": "203.0.113.50", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 100", "deny icmp 172.16.10.0 0.0.0.63 host 203.0.113.50", "exit", "interface Vlan10", "ip access-group 100 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "medium", "acl": 110, "interface": "Vlan10", "direction": "out", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan10", "acl": 110, "direction": "out", "misconfig_type": "protocol", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 110", "no deny tcp 10.0.10.0 0.0.255.255 host 10.0.3.30 eq 161", "deny udp 10.0.10.0 0.0.255.255 host 10.0.3.30 eq 161", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "high", "acl": 150, "interface": "Vlan50", "direction": "in", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan50", "acl": 150, "direction": "in", "misconfig_type": "wildcard", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 150", "no deny udp 10.0.20.0 0.0.0.15 host 10.0.3.30 eq 3389", "deny udp 10.0.20.0 0.0.0.255 host 10.0.3.30 eq 3389", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "critical", "acl": 101, "interface": "Vlan99", "direction": "out", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan99", "acl": 101, "direction": "out", "misconfig_type": "protocol", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 101", "no deny tcp 10.0.30.0 0.0.255.255 host 10.0.3.30 eq 443", "deny udp 10.0.30.0 0.0.255.255 host 10.0.3.30 eq 443", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 150, "interface": "Vlan99", "direction": "in", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan99", "acl": 150, "direction": "in", "deny_rate": 200, "top_source": "10.0.10.0 0.0.0.63", "top_dest": "10.0.1.10", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 150", "permit tcp 10.0.10.0 0.0.0.63 host 10.0.1.10 eq 123", "exit", "interface Vlan99", "ip access-group 150 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "high", "acl": 199, "interface": "GigabitEthernet0/3", "direction": "in", "src": "10.0.40.0 0.0.255.255", "dst": "198.51.100.10", "service": "udp/514", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/3", "acl": 199, "direction": "in", "deny_hits": 5000, "existing_rules_hint": ["deny udp 10.0.40.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit udp 10.0.40.0 0.0.255.255 host 198.51.100.10 eq 514", "exit", "interface GigabitEthernet0/3", "ip access-group 199 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 150, "interface": "GigabitEthernet0/2", "direction": "out", "src": "10.0.20.0 0.0.0.15", "dst": "10.0.2.20", "service": "tcp/53", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "acl": 150, "direction": "out", "deny_hits": 500, "existing_rules_hint": ["deny tcp 10.0.20.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 150", "permit tcp 10.0.20.0 0.0.0.15 host 10.0.2.20 eq 53", "exit", "interface GigabitEthernet0/2", "ip access-group 150 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "critical", "acl": 120, "interface": "Vlan40", "direction": "out", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan40", "acl": 120, "direction": "out", "misconfig_type": "wildcard", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 120", "no deny udp 10.0.30.0 0.0.255.255 host 203.0.113.50 eq 443", "deny udp 10.0.30.0 0.0.0.255 host 203.0.113.50 eq 443", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 120, "interface": "Vlan50", "direction": "in", "src": "10.0.10.0 0.0.0.255", "dst": "192.0.2.25", "service": "udp/80", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan50", "acl": 120, "direction": "in", "deny_hits": 500, "existing_rules_hint": ["deny udp 10.0.10.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 120", "permit udp 10.0.10.0 0.0.0.255 host 192.0.2.25 eq 80", "exit", "interface Vlan50", "ip access-group 120 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "high", "acl": 110, "interface": "Vlan99", "direction": "in", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan99", "acl": 110, "direction": "in", "deny_rate": 1200, "top_source": "10.0.20.0 0.0.255.255", "top_dest": "10.0.3.30", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 110", "permit tcp 10.0.20.0 0.0.255.255 host 10.0.3.30 eq 443", "exit", "interface Vlan99", "ip access-group 110 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "medium", "acl": 199, "interface": "Vlan50", "direction": "in", "src": "192.168.1.0 0.0.0.15", "dst": "192.0.2.25", "service": "tcp/8080", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan50", "acl": 199, "direction": "in", "deny_hits": 1200, "existing_rules_hint": ["deny tcp 192.168.1.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit tcp 192.168.1.0 0.0.0.15 host 192.0.2.25 eq 8080", "exit", "interface Vlan50", "ip access-group 199 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 110, "interface": "Vlan30", "direction": "in", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan30", "acl": 110, "direction": "in", "deny_rate": 200, "top_source": "172.16.10.0 0.0.0.15", "top_dest": "10.0.2.20", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 110", "permit tcp 172.16.10.0 0.0.0.15 host 10.0.2.20 eq 514", "exit", "interface Vlan30", "ip access-group 110 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 120, "interface": "GigabitEthernet0/3", "direction": "out", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "acl": 120, "direction": "out", "deny_rate": 200, "top_source": "10.0.20.0 0.0.255.255", "top_dest": "10.0.2.20", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 120", "permit tcp 10.0.20.0 0.0.255.255 host 10.0.2.20 eq 23", "exit", "interface GigabitEthernet0/3", "ip access-group 120 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 120, "interface": "Vlan10", "direction": "out", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan10", "acl": 120, "direction": "out", "deny_rate": 1200, "top_source": "10.0.20.0 0.0.0.63", "top_dest": "192.0.2.25", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 120", "permit tcp 10.0.20.0 0.0.0.63 host 192.0.2.25 eq 23", "exit", "interface Vlan10", "ip access-group 120 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "critical", "acl": 100, "interface": "Vlan30", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan30", "acl": 100, "direction": "out", "misconfig_type": "direction", "symptom": "unexpected deny"}], "cli_fix": ["interface Vlan30", "no ip access-group 100 in", "no ip access-group 100 out", "ip access-group 100 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "high", "acl": 199, "interface": "Vlan50", "direction": "in", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan50", "acl": 199, "direction": "in", "misconfig_type": "wildcard", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 199", "no deny tcp 172.16.10.0 0.0.0.255 host 10.0.3.30 eq 23", "deny tcp 172.16.10.0 0.0.0.63 host 10.0.3.30 eq 23", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 199, "interface": "Vlan20", "direction": "in", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan20", "acl": 199, "direction": "in", "deny_rate": 1200, "top_source": "10.0.20.0 0.0.255.255", "top_dest": "198.51.100.10", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 199", "permit tcp 10.0.20.0 0.0.255.255 host 198.51.100.10 eq 8080", "exit", "interface Vlan20", "ip access-group 199 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "medium", "acl": 100, "interface": "GigabitEthernet0/1", "direction": "in", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "acl": 100, "direction": "in", "misconfig_type": "direction", "symptom": "policy not applied"}], "cli_fix": ["interface GigabitEthernet0/1", "no ip access-group 100 in", "no ip access-group 100 out", "ip access-group 100 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "high", "acl": 199, "interface": "Vlan99", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan99", "acl": 199, "direction": "out", "misconfig_type": "direction", "symptom": "unexpected deny"}], "cli_fix": ["interface Vlan99", "no ip access-group 199 in", "no ip access-group 199 out", "ip access-group 199 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "high", "acl": 110, "interface": "GigabitEthernet0/3", "direction": "out", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "acl": 110, "direction": "out", "deny_rate": 500, "top_source": "10.0.40.0 0.0.0.63", "top_dest": "203.0.113.50", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 110", "deny tcp 10.0.40.0 0.0.0.63 host 203.0.113.50", "exit", "interface GigabitEthernet0/3", "ip access-group 110 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "medium", "acl": 101, "interface": "GigabitEthernet0/0", "direction": "in", "src": "10.0.10.0 0.0.0.15", "dst": "192.0.2.25", "service": "tcp/22", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "acl": 101, "direction": "in", "deny_hits": 200, "existing_rules_hint": ["deny tcp 10.0.10.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 101", "permit tcp 10.0.10.0 0.0.0.15 host 192.0.2.25 eq 22", "exit", "interface GigabitEthernet0/0", "ip access-group 101 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "high", "acl": 120, "interface": "GigabitEthernet0/2", "direction": "in", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "acl": 120, "direction": "in", "deny_rate": 200, "top_source": "10.0.40.0 0.0.0.255", "top_dest": "198.51.100.10", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 120", "deny tcp 10.0.40.0 0.0.0.255 host 198.51.100.10", "exit", "interface GigabitEthernet0/2", "ip access-group 120 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "medium", "acl": 120, "interface": "Vlan30", "direction": "out", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan30", "acl": 120, "direction": "out", "misconfig_type": "wildcard", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 120", "no deny tcp 10.0.40.0 0.0.0.255 host 10.0.3.30 eq 3389", "deny tcp 10.0.40.0 0.0.0.15 host 10.0.3.30 eq 3389", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 101, "interface": "Vlan99", "direction": "in", "src": "172.16.10.0 0.0.0.255", "dst": "198.51.100.10", "service": "tcp/80", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan99", "acl": 101, "direction": "in", "deny_hits": 1200, "existing_rules_hint": ["deny tcp 172.16.10.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 101", "permit tcp 172.16.10.0 0.0.0.255 host 198.51.100.10 eq 80", "exit", "interface Vlan99", "ip access-group 101 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "high", "acl": 110, "interface": "GigabitEthernet0/0", "direction": "in", "src": "10.0.30.0 0.0.0.255", "dst": "10.0.1.10", "service": "udp/123", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/0", "acl": 110, "direction": "in", "deny_hits": 500, "existing_rules_hint": ["deny udp 10.0.30.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit udp 10.0.30.0 0.0.0.255 host 10.0.1.10 eq 123", "exit", "interface GigabitEthernet0/0", "ip access-group 110 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "high", "acl": 120, "interface": "GigabitEthernet0/2", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "acl": 120, "direction": "out", "misconfig_type": "direction", "symptom": "unexpected permit"}], "cli_fix": ["interface GigabitEthernet0/2", "no ip access-group 120 in", "no ip access-group 120 out", "ip access-group 120 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 110, "interface": "Vlan20", "direction": "in", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan20", "acl": 110, "direction": "in", "deny_rate": 5000, "top_source": "192.168.1.0 0.0.0.63", "top_dest": "10.0.2.20", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 110", "deny tcp 192.168.1.0 0.0.0.63 host 10.0.2.20", "exit", "interface Vlan20", "ip access-group 110 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "critical", "acl": 101, "interface": "GigabitEthernet0/0", "direction": "in", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "acl": 101, "direction": "in", "misconfig_type": "direction", "symptom": "unexpected deny"}], "cli_fix": ["interface GigabitEthernet0/0", "no ip access-group 101 in", "no ip access-group 101 out", "ip access-group 101 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "medium", "acl": 110, "interface": "GigabitEthernet0/2", "direction": "in", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "acl": 110, "direction": "in", "misconfig_type": "protocol", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 110", "no deny udp 10.0.30.0 0.0.0.255 host 198.51.100.10 eq 22", "deny tcp 10.0.30.0 0.0.0.255 host 198.51.100.10 eq 22", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "high", "acl": 150, "interface": "Vlan50", "direction": "out", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan50", "acl": 150, "direction": "out", "deny_rate": 200, "top_source": "10.0.40.0 0.0.0.255", "top_dest": "10.0.2.20", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 150", "permit tcp 10.0.40.0 0.0.0.255 host 10.0.2.20 eq 161", "exit", "interface Vlan50", "ip access-group 150 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "high", "acl": 100, "interface": "Vlan50", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan50", "acl": 100, "direction": "in", "deny_rate": 1200, "top_source": "10.0.30.0 0.0.0.255", "top_dest": "192.0.2.25", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 100", "deny icmp 10.0.30.0 0.0.0.255 host 192.0.2.25", "exit", "interface Vlan50", "ip access-group 100 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "high", "acl": 101, "interface": "GigabitEthernet0/1", "direction": "out", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "acl": 101, "direction": "out", "deny_rate": 200, "top_source": "10.0.40.0 0.0.255.255", "top_dest": "10.0.1.10", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 101", "permit tcp 10.0.40.0 0.0.255.255 host 10.0.1.10 eq 23", "exit", "interface GigabitEthernet0/1", "ip access-group 101 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "high", "acl": 100, "interface": "Vlan30", "direction": "in", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan30", "acl": 100, "direction": "in", "misconfig_type": "protocol", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 100", "no deny tcp 10.0.20.0 0.0.255.255 host 198.51.100.10 eq 123", "deny udp 10.0.20.0 0.0.255.255 host 198.51.100.10 eq 123", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 110, "interface": "GigabitEthernet0/1", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "acl": 110, "direction": "out", "deny_rate": 500, "top_source": "10.0.40.0 0.0.0.255", "top_dest": "203.0.113.50", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 110", "deny icmp 10.0.40.0 0.0.0.255 host 203.0.113.50", "exit", "interface GigabitEthernet0/1", "ip access-group 110 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 101, "interface": "Vlan10", "direction": "out", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan10", "acl": 101, "direction": "out", "deny_rate": 500, "top_source": "10.0.10.0 0.0.0.255", "top_dest": "203.0.113.50", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 101", "permit tcp 10.0.10.0 0.0.0.255 host 203.0.113.50 eq 514", "exit", "interface Vlan10", "ip access-group 101 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 100, "interface": "GigabitEthernet0/0", "direction": "in", "src": "10.0.10.0 0.0.0.15", "dst": "203.0.113.50", "service": "tcp/123", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "acl": 100, "direction": "in", "deny_hits": 500, "existing_rules_hint": ["deny tcp 10.0.10.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 100", "permit tcp 10.0.10.0 0.0.0.15 host 203.0.113.50 eq 123", "exit", "interface GigabitEthernet0/0", "ip access-group 100 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "high", "acl": 150, "interface": "GigabitEthernet0/2", "direction": "out", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/2", "acl": 150, "direction": "out", "deny_rate": 5000, "top_source": "10.0.40.0 0.0.0.255", "top_dest": "192.0.2.25", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 150", "deny icmp 10.0.40.0 0.0.0.255 host 192.0.2.25", "exit", "interface GigabitEthernet0/2", "ip access-group 150 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "high", "acl": 101, "interface": "Vlan30", "direction": "in", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan30", "acl": 101, "direction": "in", "misconfig_type": "protocol", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 101", "no deny tcp 172.16.10.0 0.0.0.255 host 198.51.100.10 eq 123", "deny udp 172.16.10.0 0.0.0.255 host 198.51.100.10 eq 123", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "high", "acl": 100, "interface": "Vlan20", "direction": "in", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan20", "acl": 100, "direction": "in", "misconfig_type": "protocol", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 100", "no deny udp 192.168.1.0 0.0.255.255 host 192.0.2.25 eq 80", "deny tcp 192.168.1.0 0.0.255.255 host 192.0.2.25 eq 80", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "high", "acl": 101, "interface": "Vlan20", "direction": "in", "src": "10.0.30.0 0.0.255.255", "dst": "10.0.2.20", "service": "tcp/161", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan20", "acl": 101, "direction": "in", "deny_hits": 200, "existing_rules_hint": ["deny tcp 10.0.30.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 101", "permit tcp 10.0.30.0 0.0.255.255 host 10.0.2.20 eq 161", "exit", "interface Vlan20", "ip access-group 101 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "high", "acl": 199, "interface": "Vlan40", "direction": "out", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan40", "acl": 199, "direction": "out", "deny_rate": 5000, "top_source": "10.0.40.0 0.0.255.255", "top_dest": "10.0.3.30", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 199", "permit tcp 10.0.40.0 0.0.255.255 host 10.0.3.30 eq 53", "exit", "interface Vlan40", "ip access-group 199 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 120, "interface": "Vlan20", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan20", "acl": 120, "direction": "out", "deny_rate": 5000, "top_source": "172.16.10.0 0.0.0.63", "top_dest": "198.51.100.10", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 120", "permit tcp 172.16.10.0 0.0.0.63 host 198.51.100.10 eq 123", "exit", "interface Vlan20", "ip access-group 120 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "medium", "acl": 199, "interface": "GigabitEthernet0/1", "direction": "in", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "acl": 199, "direction": "in", "misconfig_type": "protocol", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 199", "no deny udp 10.0.40.0 0.0.255.255 host 10.0.3.30 eq 3389", "deny tcp 10.0.40.0 0.0.255.255 host 10.0.3.30 eq 3389", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 101, "interface": "Vlan40", "direction": "in", "src": "10.0.30.0 0.0.0.255", "dst": "10.0.1.10", "service": "udp/161", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan40", "acl": 101, "direction": "in", "deny_hits": 500, "existing_rules_hint": ["deny udp 10.0.30.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 101", "permit udp 10.0.30.0 0.0.0.255 host 10.0.1.10 eq 161", "exit", "interface Vlan40", "ip access-group 101 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "critical", "acl": 110, "interface": "GigabitEthernet0/2", "direction": "out", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "acl": 110, "direction": "out", "misconfig_type": "wildcard", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 110", "no deny udp 10.0.20.0 0.0.0.255 host 10.0.2.20 eq 8080", "deny udp 10.0.20.0 0.0.0.63 host 10.0.2.20 eq 8080", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "medium", "acl": 110, "interface": "GigabitEthernet0/0", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "acl": 110, "direction": "in", "deny_rate": 5000, "top_source": "10.0.20.0 0.0.0.63", "top_dest": "10.0.1.10", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 110", "deny icmp 10.0.20.0 0.0.0.63 host 10.0.1.10", "exit", "interface GigabitEthernet0/0", "ip access-group 110 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "high", "acl": 199, "interface": "Vlan99", "direction": "in", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan99", "acl": 199, "direction": "in", "misconfig_type": "protocol", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 199", "no deny udp 10.0.30.0 0.0.0.63 host 10.0.1.10 eq 443", "deny tcp 10.0.30.0 0.0.0.63 host 10.0.1.10 eq 443", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "critical", "acl": 110, "interface": "GigabitEthernet0/3", "direction": "in", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "acl": 110, "direction": "in", "misconfig_type": "wildcard", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 110", "no deny tcp 10.0.20.0 0.0.255.255 host 192.0.2.25 eq 8080", "deny tcp 10.0.20.0 0.0.0.255 host 192.0.2.25 eq 8080", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 101, "interface": "GigabitEthernet0/3", "direction": "out", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/3", "acl": 101, "direction": "out", "deny_rate": 5000, "top_source": "10.0.10.0 0.0.255.255", "top_dest": "203.0.113.50", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 101", "deny tcp 10.0.10.0 0.0.255.255 host 203.0.113.50", "exit", "interface GigabitEthernet0/3", "ip access-group 101 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "medium", "acl": 101, "interface": "Vlan20", "direction": "in", "src": "10.0.30.0 0.0.0.63", "dst": "198.51.100.10", "service": "udp/123", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan20", "acl": 101, "direction": "in", "deny_hits": 1200, "existing_rules_hint": ["deny udp 10.0.30.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 101", "permit udp 10.0.30.0 0.0.0.63 host 198.51.100.10 eq 123", "exit", "interface Vlan20", "ip access-group 101 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "high", "acl": 150, "interface": "GigabitEthernet0/3", "direction": "out", "src": "10.0.10.0 0.0.255.255", "dst": "198.51.100.10", "service": "tcp/53", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "acl": 150, "direction": "out", "deny_hits": 500, "existing_rules_hint": ["deny tcp 10.0.10.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 150", "permit tcp 10.0.10.0 0.0.255.255 host 198.51.100.10 eq 53", "exit", "interface GigabitEthernet0/3", "ip access-group 150 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "medium", "acl": 101, "interface": "GigabitEthernet0/3", "direction": "in", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/3", "acl": 101, "direction": "in", "deny_rate": 5000, "top_source": "10.0.20.0 0.0.255.255", "top_dest": "10.0.3.30", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 101", "deny udp 10.0.20.0 0.0.255.255 host 10.0.3.30", "exit", "interface GigabitEthernet0/3", "ip access-group 101 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "critical", "acl": 120, "interface": "Vlan50", "direction": "in", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan50", "acl": 120, "direction": "in", "misconfig_type": "wildcard", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 120", "no deny udp 10.0.20.0 0.0.0.255 host 10.0.1.10 eq 123", "deny udp 10.0.20.0 0.0.0.63 host 10.0.1.10 eq 123", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "medium", "acl": 100, "interface": "Vlan30", "direction": "out", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan30", "acl": 100, "direction": "out", "misconfig_type": "wildcard", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 100", "no deny udp 10.0.30.0 0.0.0.255 host 10.0.3.30 eq 3389", "deny udp 10.0.30.0 0.0.255.255 host 10.0.3.30 eq 3389", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "medium", "acl": 150, "interface": "GigabitEthernet0/2", "direction": "in", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "acl": 150, "direction": "in", "misconfig_type": "direction", "symptom": "unexpected permit"}], "cli_fix": ["interface GigabitEthernet0/2", "no ip access-group 150 in", "no ip access-group 150 out", "ip access-group 150 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "medium", "acl": 110, "interface": "Vlan50", "direction": "out", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan50", "acl": 110, "direction": "out", "deny_rate": 200, "top_source": "10.0.40.0 0.0.0.15", "top_dest": "10.0.3.30", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 110", "permit tcp 10.0.40.0 0.0.0.15 host 10.0.3.30 eq 3389", "exit", "interface Vlan50", "ip access-group 110 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "critical", "acl": 120, "interface": "GigabitEthernet0/2", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/2", "acl": 120, "direction": "out", "misconfig_type": "direction", "symptom": "unexpected deny"}], "cli_fix": ["interface GigabitEthernet0/2", "no ip access-group 120 in", "no ip access-group 120 out", "ip access-group 120 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "high", "acl": 101, "interface": "Vlan50", "direction": "in", "src": "10.0.10.0 0.0.255.255", "dst": "203.0.113.50", "service": "udp/443", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan50", "acl": 101, "direction": "in", "deny_hits": 1200, "existing_rules_hint": ["deny udp 10.0.10.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 101", "permit udp 10.0.10.0 0.0.255.255 host 203.0.113.50 eq 443", "exit", "interface Vlan50", "ip access-group 101 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "critical", "acl": 199, "interface": "Vlan20", "direction": "out", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan20", "acl": 199, "direction": "out", "misconfig_type": "wildcard", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 199", "no deny udp 10.0.30.0 0.0.0.63 host 203.0.113.50 eq 161", "deny udp 10.0.30.0 0.0.0.255 host 203.0.113.50 eq 161", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "medium", "acl": 120, "interface": "Vlan40", "direction": "in", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan40", "acl": 120, "direction": "in", "misconfig_type": "wildcard", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 120", "no deny udp 10.0.10.0 0.0.255.255 host 10.0.2.20 eq 23", "deny udp 10.0.10.0 0.0.0.15 host 10.0.2.20 eq 23", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "medium", "acl": 110, "interface": "Vlan99", "direction": "out", "src": "192.168.1.0 0.0.0.15", "dst": "10.0.2.20", "service": "tcp/3389", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan99", "acl": 110, "direction": "out", "deny_hits": 1200, "existing_rules_hint": ["deny tcp 192.168.1.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit tcp 192.168.1.0 0.0.0.15 host 10.0.2.20 eq 3389", "exit", "interface Vlan99", "ip access-group 110 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "high", "acl": 120, "interface": "Vlan30", "direction": "in", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan30", "acl": 120, "direction": "in", "deny_rate": 5000, "top_source": "192.168.1.0 0.0.0.255", "top_dest": "192.0.2.25", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 120", "deny icmp 192.168.1.0 0.0.0.255 host 192.0.2.25", "exit", "interface Vlan30", "ip access-group 120 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "high", "acl": 150, "interface": "GigabitEthernet0/0", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/0", "acl": 150, "direction": "in", "deny_rate": 1200, "top_source": "10.0.20.0 0.0.255.255", "top_dest": "10.0.2.20", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 150", "permit tcp 10.0.20.0 0.0.255.255 host 10.0.2.20 eq 23", "exit", "interface GigabitEthernet0/0", "ip access-group 150 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "medium", "acl": 100, "interface": "Vlan10", "direction": "out", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan10", "acl": 100, "direction": "out", "misconfig_type": "protocol", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 100", "no deny udp 10.0.40.0 0.0.255.255 host 198.51.100.10 eq 514", "deny tcp 10.0.40.0 0.0.255.255 host 198.51.100.10 eq 514", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "high", "acl": 150, "interface": "Vlan99", "direction": "out", "src": "10.0.20.0 0.0.255.255", "dst": "203.0.113.50", "service": "udp/123", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan99", "acl": 150, "direction": "out", "deny_hits": 5000, "existing_rules_hint": ["deny udp 10.0.20.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 150", "permit udp 10.0.20.0 0.0.255.255 host 203.0.113.50 eq 123", "exit", "interface Vlan99", "ip access-group 150 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "high", "acl": 100, "interface": "GigabitEthernet0/1", "direction": "in", "src": "10.0.10.0 0.0.0.15", "dst": "10.0.2.20", "service": "udp/3389", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "acl": 100, "direction": "in", "deny_hits": 5000, "existing_rules_hint": ["deny udp 10.0.10.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 100", "permit udp 10.0.10.0 0.0.0.15 host 10.0.2.20 eq 3389", "exit", "interface GigabitEthernet0/1", "ip access-group 100 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "high", "acl": 101, "interface": "GigabitEthernet0/1", "direction": "out", "src": "10.0.40.0 0.0.0.15", "dst": "10.0.2.20", "service": "udp/23", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "acl": 101, "direction": "out", "deny_hits": 200, "existing_rules_hint": ["deny udp 10.0.40.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 101", "permit udp 10.0.40.0 0.0.0.15 host 10.0.2.20 eq 23", "exit", "interface GigabitEthernet0/1", "ip access-group 101 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "high", "acl": 101, "interface": "Vlan50", "direction": "out", "src": "172.16.10.0 0.0.0.63", "dst": "198.51.100.10", "service": "udp/443", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan50", "acl": 101, "direction": "out", "deny_hits": 1200, "existing_rules_hint": ["deny udp 172.16.10.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 101", "permit udp 172.16.10.0 0.0.0.63 host 198.51.100.10 eq 443", "exit", "interface Vlan50", "ip access-group 101 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 120, "interface": "Vlan20", "direction": "out", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan20", "acl": 120, "direction": "out", "deny_rate": 5000, "top_source": "172.16.10.0 0.0.0.15", "top_dest": "192.0.2.25", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 120", "deny icmp 172.16.10.0 0.0.0.15 host 192.0.2.25", "exit", "interface Vlan20", "ip access-group 120 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "medium", "acl": 100, "interface": "GigabitEthernet0/3", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/3", "acl": 100, "direction": "out", "deny_rate": 500, "top_source": "10.0.30.0 0.0.0.63", "top_dest": "10.0.2.20", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 100", "deny tcp 10.0.30.0 0.0.0.63 host 10.0.2.20", "exit", "interface GigabitEthernet0/3", "ip access-group 100 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "high", "acl": 110, "interface": "Vlan99", "direction": "out", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan99", "acl": 110, "direction": "out", "deny_rate": 1200, "top_source": "10.0.10.0 0.0.0.63", "top_dest": "203.0.113.50", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 110", "permit tcp 10.0.10.0 0.0.0.63 host 203.0.113.50 eq 161", "exit", "interface Vlan99", "ip access-group 110 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "medium", "acl": 199, "interface": "GigabitEthernet0/3", "direction": "in", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/3", "acl": 199, "direction": "in", "misconfig_type": "protocol", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 199", "no deny udp 172.16.10.0 0.0.0.15 host 10.0.3.30 eq 22", "deny tcp 172.16.10.0 0.0.0.15 host 10.0.3.30 eq 22", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "critical", "acl": 101, "interface": "GigabitEthernet0/3", "direction": "in", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/3", "acl": 101, "direction": "in", "misconfig_type": "wildcard", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 101", "no deny udp 10.0.20.0 0.0.0.15 host 198.51.100.10 eq 53", "deny udp 10.0.20.0 0.0.0.63 host 198.51.100.10 eq 53", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "critical", "acl": 101, "interface": "Vlan10", "direction": "out", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan10", "acl": 101, "direction": "out", "misconfig_type": "protocol", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 101", "no deny tcp 172.16.10.0 0.0.0.63 host 198.51.100.10 eq 8080", "deny udp 172.16.10.0 0.0.0.63 host 198.51.100.10 eq 8080", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 150, "interface": "GigabitEthernet0/0", "direction": "out", "src": "10.0.20.0 0.0.255.255", "dst": "10.0.2.20", "service": "tcp/22", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "acl": 150, "direction": "out", "deny_hits": 1200, "existing_rules_hint": ["deny tcp 10.0.20.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 150", "permit tcp 10.0.20.0 0.0.255.255 host 10.0.2.20 eq 22", "exit", "interface GigabitEthernet0/0", "ip access-group 150 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "high", "acl": 199, "interface": "GigabitEthernet0/2", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "acl": 199, "direction": "out", "misconfig_type": "direction", "symptom": "policy not applied"}], "cli_fix": ["interface GigabitEthernet0/2", "no ip access-group 199 in", "no ip access-group 199 out", "ip access-group 199 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "high", "acl": 110, "interface": "GigabitEthernet0/0", "direction": "in", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/0", "acl": 110, "direction": "in", "misconfig_type": "direction", "symptom": "policy not applied"}], "cli_fix": ["interface GigabitEthernet0/0", "no ip access-group 110 in", "no ip access-group 110 out", "ip access-group 110 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 110, "interface": "Vlan99", "direction": "in", "src": "10.0.10.0 0.0.0.63", "dst": "10.0.3.30", "service": "udp/22", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan99", "acl": 110, "direction": "in", "deny_hits": 200, "existing_rules_hint": ["deny udp 10.0.10.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit udp 10.0.10.0 0.0.0.63 host 10.0.3.30 eq 22", "exit", "interface Vlan99", "ip access-group 110 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "critical", "acl": 199, "interface": "GigabitEthernet0/0", "direction": "out", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/0", "acl": 199, "direction": "out", "misconfig_type": "wildcard", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 199", "no deny udp 10.0.30.0 0.0.255.255 host 10.0.2.20 eq 8080", "deny udp 10.0.30.0 0.0.0.15 host 10.0.2.20 eq 8080", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "high", "acl": 150, "interface": "Vlan99", "direction": "out", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan99", "acl": 150, "direction": "out", "misconfig_type": "protocol", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 150", "no deny tcp 10.0.30.0 0.0.0.255 host 192.0.2.25 eq 514", "deny udp 10.0.30.0 0.0.0.255 host 192.0.2.25 eq 514", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "critical", "acl": 199, "interface": "GigabitEthernet0/3", "direction": "out", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "acl": 199, "direction": "out", "misconfig_type": "protocol", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 199", "no deny tcp 10.0.40.0 0.0.0.255 host 10.0.3.30 eq 514", "deny udp 10.0.40.0 0.0.0.255 host 10.0.3.30 eq 514", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "medium", "acl": 120, "interface": "Vlan10", "direction": "in", "src": "10.0.30.0 0.0.0.255", "dst": "10.0.2.20", "service": "udp/123", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan10", "acl": 120, "direction": "in", "deny_hits": 200, "existing_rules_hint": ["deny udp 10.0.30.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 120", "permit udp 10.0.30.0 0.0.0.255 host 10.0.2.20 eq 123", "exit", "interface Vlan10", "ip access-group 120 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "high", "acl": 101, "interface": "Vlan40", "direction": "in", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan40", "acl": 101, "direction": "in", "misconfig_type": "wildcard", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 101", "no deny tcp 172.16.10.0 0.0.0.255 host 203.0.113.50 eq 53", "deny tcp 172.16.10.0 0.0.0.15 host 203.0.113.50 eq 53", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "medium", "acl": 100, "interface": "GigabitEthernet0/1", "direction": "out", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "acl": 100, "direction": "out", "misconfig_type": "wildcard", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 100", "no deny tcp 192.168.1.0 0.0.0.63 host 10.0.2.20 eq 161", "deny tcp 192.168.1.0 0.0.0.15 host 10.0.2.20 eq 161", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 150, "interface": "GigabitEthernet0/0", "direction": "in", "src": "10.0.20.0 0.0.255.255", "dst": "10.0.3.30", "service": "udp/123", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "acl": 150, "direction": "in", "deny_hits": 5000, "existing_rules_hint": ["deny udp 10.0.20.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 150", "permit udp 10.0.20.0 0.0.255.255 host 10.0.3.30 eq 123", "exit", "interface GigabitEthernet0/0", "ip access-group 150 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "medium", "acl": 120, "interface": "GigabitEthernet0/0", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "acl": 120, "direction": "out", "misconfig_type": "direction", "symptom": "policy not applied"}], "cli_fix": ["interface GigabitEthernet0/0", "no ip access-group 120 in", "no ip access-group 120 out", "ip access-group 120 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 150, "interface": "Vlan40", "direction": "out", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan40", "acl": 150, "direction": "out", "deny_rate": 500, "top_source": "10.0.30.0 0.0.0.255", "top_dest": "203.0.113.50", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 150", "deny udp 10.0.30.0 0.0.0.255 host 203.0.113.50", "exit", "interface Vlan40", "ip access-group 150 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "high", "acl": 100, "interface": "GigabitEthernet0/2", "direction": "in", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "acl": 100, "direction": "in", "misconfig_type": "direction", "symptom": "unexpected permit"}], "cli_fix": ["interface GigabitEthernet0/2", "no ip access-group 100 in", "no ip access-group 100 out", "ip access-group 100 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 150, "interface": "Vlan40", "direction": "in", "src": "10.0.30.0 0.0.0.255", "dst": "192.0.2.25", "service": "tcp/3389", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan40", "acl": 150, "direction": "in", "deny_hits": 200, "existing_rules_hint": ["deny tcp 10.0.30.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 150", "permit tcp 10.0.30.0 0.0.0.255 host 192.0.2.25 eq 3389", "exit", "interface Vlan40", "ip access-group 150 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "critical", "acl": 150, "interface": "Vlan99", "direction": "in", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan99", "acl": 150, "direction": "in", "misconfig_type": "protocol", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 150", "no deny tcp 10.0.30.0 0.0.0.255 host 10.0.1.10 eq 53", "deny udp 10.0.30.0 0.0.0.255 host 10.0.1.10 eq 53", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "critical", "acl": 101, "interface": "Vlan10", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan10", "acl": 101, "direction": "out", "misconfig_type": "direction", "symptom": "unexpected deny"}], "cli_fix": ["interface Vlan10", "no ip access-group 101 in", "no ip access-group 101 out", "ip access-group 101 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "critical", "acl": 100, "interface": "Vlan50", "direction": "in", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan50", "acl": 100, "direction": "in", "misconfig_type": "direction", "symptom": "policy not applied"}], "cli_fix": ["interface Vlan50", "no ip access-group 100 in", "no ip access-group 100 out", "ip access-group 100 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 101, "interface": "Vlan30", "direction": "in", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan30", "acl": 101, "direction": "in", "deny_rate": 200, "top_source": "10.0.10.0 0.0.255.255", "top_dest": "192.0.2.25", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 101", "deny udp 10.0.10.0 0.0.255.255 host 192.0.2.25", "exit", "interface Vlan30", "ip access-group 101 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 100, "interface": "Vlan30", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan30", "acl": 100, "direction": "in", "deny_rate": 500, "top_source": "10.0.30.0 0.0.0.255", "top_dest": "198.51.100.10", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 100", "permit tcp 10.0.30.0 0.0.0.255 host 198.51.100.10 eq 443", "exit", "interface Vlan30", "ip access-group 100 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "medium", "acl": 150, "interface": "Vlan30", "direction": "in", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan30", "acl": 150, "direction": "in", "misconfig_type": "protocol", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 150", "no deny udp 10.0.20.0 0.0.0.15 host 192.0.2.25 eq 22", "deny tcp 10.0.20.0 0.0.0.15 host 192.0.2.25 eq 22", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "critical", "acl": 120, "interface": "Vlan30", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan30", "acl": 120, "direction": "out", "misconfig_type": "direction", "symptom": "policy not applied"}], "cli_fix": ["interface Vlan30", "no ip access-group 120 in", "no ip access-group 120 out", "ip access-group 120 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "medium", "acl": 199, "interface": "GigabitEthernet0/1", "direction": "in", "src": "10.0.20.0 0.0.255.255", "dst": "198.51.100.10", "service": "udp/8080", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "acl": 199, "direction": "in", "deny_hits": 500, "existing_rules_hint": ["deny udp 10.0.20.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit udp 10.0.20.0 0.0.255.255 host 198.51.100.10 eq 8080", "exit", "interface GigabitEthernet0/1", "ip access-group 199 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "high", "acl": 199, "interface": "GigabitEthernet0/1", "direction": "in", "src": "192.168.1.0 0.0.0.255", "dst": "198.51.100.10", "service": "udp/8080", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "acl": 199, "direction": "in", "deny_hits": 5000, "existing_rules_hint": ["deny udp 192.168.1.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit udp 192.168.1.0 0.0.0.255 host 198.51.100.10 eq 8080", "exit", "interface GigabitEthernet0/1", "ip access-group 199 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "high", "acl": 150, "interface": "Vlan50", "direction": "in", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan50", "acl": 150, "direction": "in", "misconfig_type": "direction", "symptom": "unexpected deny"}], "cli_fix": ["interface Vlan50", "no ip access-group 150 in", "no ip access-group 150 out", "ip access-group 150 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "medium", "acl": 199, "interface": "Vlan50", "direction": "out", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan50", "acl": 199, "direction": "out", "misconfig_type": "protocol", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 199", "no deny udp 10.0.10.0 0.0.0.255 host 10.0.2.20 eq 8080", "deny tcp 10.0.10.0 0.0.0.255 host 10.0.2.20 eq 8080", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "high", "acl": 100, "interface": "Vlan30", "direction": "out", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan30", "acl": 100, "direction": "out", "deny_rate": 500, "top_source": "10.0.40.0 0.0.255.255", "top_dest": "198.51.100.10", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 100", "deny udp 10.0.40.0 0.0.255.255 host 198.51.100.10", "exit", "interface Vlan30", "ip access-group 100 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "critical", "acl": 101, "interface": "GigabitEthernet0/3", "direction": "out", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "acl": 101, "direction": "out", "misconfig_type": "protocol", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 101", "no deny tcp 192.168.1.0 0.0.0.255 host 10.0.2.20 eq 123", "deny udp 192.168.1.0 0.0.0.255 host 10.0.2.20 eq 123", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "medium", "acl": 100, "interface": "GigabitEthernet0/3", "direction": "in", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/3", "acl": 100, "direction": "in", "misconfig_type": "wildcard", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 100", "no deny tcp 10.0.20.0 0.0.0.15 host 10.0.3.30 eq 23", "deny tcp 10.0.20.0 0.0.0.255 host 10.0.3.30 eq 23", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "medium", "acl": 110, "interface": "GigabitEthernet0/3", "direction": "out", "src": "172.16.10.0 0.0.0.15", "dst": "10.0.2.20", "service": "udp/8080", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "acl": 110, "direction": "out", "deny_hits": 1200, "existing_rules_hint": ["deny udp 172.16.10.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit udp 172.16.10.0 0.0.0.15 host 10.0.2.20 eq 8080", "exit", "interface GigabitEthernet0/3", "ip access-group 110 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "critical", "acl": 110, "interface": "Vlan10", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan10", "acl": 110, "direction": "out", "misconfig_type": "direction", "symptom": "unexpected deny"}], "cli_fix": ["interface Vlan10", "no ip access-group 110 in", "no ip access-group 110 out", "ip access-group 110 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "critical", "acl": 199, "interface": "GigabitEthernet0/3", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/3", "acl": 199, "direction": "out", "misconfig_type": "direction", "symptom": "unexpected permit"}], "cli_fix": ["interface GigabitEthernet0/3", "no ip access-group 199 in", "no ip access-group 199 out", "ip access-group 199 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "medium", "acl": 101, "interface": "Vlan40", "direction": "in", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan40", "acl": 101, "direction": "in", "misconfig_type": "protocol", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 101", "no deny udp 10.0.10.0 0.0.255.255 host 203.0.113.50 eq 53", "deny tcp 10.0.10.0 0.0.255.255 host 203.0.113.50 eq 53", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "medium", "acl": 101, "interface": "GigabitEthernet0/3", "direction": "in", "src": "10.0.20.0 0.0.0.15", "dst": "203.0.113.50", "service": "tcp/123", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/3", "acl": 101, "direction": "in", "deny_hits": 5000, "existing_rules_hint": ["deny tcp 10.0.20.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 101", "permit tcp 10.0.20.0 0.0.0.15 host 203.0.113.50 eq 123", "exit", "interface GigabitEthernet0/3", "ip access-group 101 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 120, "interface": "Vlan10", "direction": "out", "src": "10.0.20.0 0.0.0.63", "dst": "198.51.100.10", "service": "udp/123", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan10", "acl": 120, "direction": "out", "deny_hits": 5000, "existing_rules_hint": ["deny udp 10.0.20.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 120", "permit udp 10.0.20.0 0.0.0.63 host 198.51.100.10 eq 123", "exit", "interface Vlan10", "ip access-group 120 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 199, "interface": "GigabitEthernet0/2", "direction": "in", "src": "10.0.30.0 0.0.255.255", "dst": "192.0.2.25", "service": "udp/23", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "acl": 199, "direction": "in", "deny_hits": 1200, "existing_rules_hint": ["deny udp 10.0.30.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit udp 10.0.30.0 0.0.255.255 host 192.0.2.25 eq 23", "exit", "interface GigabitEthernet0/2", "ip access-group 199 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "critical", "acl": 150, "interface": "Vlan40", "direction": "out", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan40", "acl": 150, "direction": "out", "misconfig_type": "protocol", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 150", "no deny tcp 10.0.40.0 0.0.0.255 host 192.0.2.25 eq 514", "deny udp 10.0.40.0 0.0.0.255 host 192.0.2.25 eq 514", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "critical", "acl": 100, "interface": "Vlan50", "direction": "out", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan50", "acl": 100, "direction": "out", "misconfig_type": "protocol", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 100", "no deny tcp 192.168.1.0 0.0.0.15 host 10.0.2.20 eq 161", "deny udp 192.168.1.0 0.0.0.15 host 10.0.2.20 eq 161", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "medium", "acl": 110, "interface": "GigabitEthernet0/2", "direction": "in", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/2", "acl": 110, "direction": "in", "misconfig_type": "protocol", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 110", "no deny tcp 10.0.20.0 0.0.255.255 host 10.0.1.10 eq 161", "deny udp 10.0.20.0 0.0.255.255 host 10.0.1.10 eq 161", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 100, "interface": "GigabitEthernet0/3", "direction": "out", "src": "10.0.20.0 0.0.255.255", "dst": "10.0.2.20", "service": "tcp/161", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/3", "acl": 100, "direction": "out", "deny_hits": 5000, "existing_rules_hint": ["deny tcp 10.0.20.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 100", "permit tcp 10.0.20.0 0.0.255.255 host 10.0.2.20 eq 161", "exit", "interface GigabitEthernet0/3", "ip access-group 100 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "high", "acl": 120, "interface": "GigabitEthernet0/2", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/2", "acl": 120, "direction": "out", "deny_rate": 5000, "top_source": "10.0.40.0 0.0.0.255", "top_dest": "192.0.2.25", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 120", "permit tcp 10.0.40.0 0.0.0.255 host 192.0.2.25 eq 123", "exit", "interface GigabitEthernet0/2", "ip access-group 120 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "medium", "acl": 100, "interface": "Vlan40", "direction": "out", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan40", "acl": 100, "direction": "out", "misconfig_type": "wildcard", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 100", "no deny tcp 10.0.10.0 0.0.0.63 host 10.0.2.20 eq 161", "deny tcp 10.0.10.0 0.0.0.15 host 10.0.2.20 eq 161", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 120, "interface": "Vlan20", "direction": "in", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan20", "acl": 120, "direction": "in", "deny_rate": 500, "top_source": "10.0.40.0 0.0.255.255", "top_dest": "192.0.2.25", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 120", "permit tcp 10.0.40.0 0.0.255.255 host 192.0.2.25 eq 23", "exit", "interface Vlan20", "ip access-group 120 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "high", "acl": 101, "interface": "Vlan20", "direction": "in", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan20", "acl": 101, "direction": "in", "deny_rate": 200, "top_source": "172.16.10.0 0.0.255.255", "top_dest": "10.0.2.20", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 101", "deny udp 172.16.10.0 0.0.255.255 host 10.0.2.20", "exit", "interface Vlan20", "ip access-group 101 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "high", "acl": 100, "interface": "GigabitEthernet0/3", "direction": "out", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/3", "acl": 100, "direction": "out", "deny_rate": 200, "top_source": "10.0.40.0 0.0.0.15", "top_dest": "203.0.113.50", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 100", "permit tcp 10.0.40.0 0.0.0.15 host 203.0.113.50 eq 80", "exit", "interface GigabitEthernet0/3", "ip access-group 100 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "medium", "acl": 101, "interface": "GigabitEthernet0/1", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "acl": 101, "direction": "out", "misconfig_type": "direction", "symptom": "unexpected permit"}], "cli_fix": ["interface GigabitEthernet0/1", "no ip access-group 101 in", "no ip access-group 101 out", "ip access-group 101 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "high", "acl": 101, "interface": "GigabitEthernet0/1", "direction": "in", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "acl": 101, "direction": "in", "deny_rate": 1200, "top_source": "10.0.30.0 0.0.0.63", "top_dest": "10.0.2.20", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 101", "permit tcp 10.0.30.0 0.0.0.63 host 10.0.2.20 eq 161", "exit", "interface GigabitEthernet0/1", "ip access-group 101 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "medium", "acl": 101, "interface": "Vlan50", "direction": "in", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan50", "acl": 101, "direction": "in", "deny_rate": 1200, "top_source": "10.0.20.0 0.0.0.63", "top_dest": "192.0.2.25", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 101", "deny tcp 10.0.20.0 0.0.0.63 host 192.0.2.25", "exit", "interface Vlan50", "ip access-group 101 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 120, "interface": "GigabitEthernet0/1", "direction": "in", "src": "10.0.30.0 0.0.0.255", "dst": "203.0.113.50", "service": "udp/23", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "acl": 120, "direction": "in", "deny_hits": 200, "existing_rules_hint": ["deny udp 10.0.30.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 120", "permit udp 10.0.30.0 0.0.0.255 host 203.0.113.50 eq 23", "exit", "interface GigabitEthernet0/1", "ip access-group 120 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "high", "acl": 199, "interface": "Vlan99", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan99", "acl": 199, "direction": "in", "deny_rate": 1200, "top_source": "10.0.20.0 0.0.255.255", "top_dest": "203.0.113.50", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 199", "deny tcp 10.0.20.0 0.0.255.255 host 203.0.113.50", "exit", "interface Vlan99", "ip access-group 199 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "critical", "acl": 100, "interface": "Vlan99", "direction": "in", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan99", "acl": 100, "direction": "in", "misconfig_type": "wildcard", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 100", "no deny udp 10.0.40.0 0.0.0.255 host 10.0.1.10 eq 22", "deny udp 10.0.40.0 0.0.0.63 host 10.0.1.10 eq 22", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 199, "interface": "GigabitEthernet0/2", "direction": "out", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "acl": 199, "direction": "out", "deny_rate": 5000, "top_source": "10.0.10.0 0.0.0.15", "top_dest": "203.0.113.50", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 199", "permit tcp 10.0.10.0 0.0.0.15 host 203.0.113.50 eq 80", "exit", "interface GigabitEthernet0/2", "ip access-group 199 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "medium", "acl": 110, "interface": "GigabitEthernet0/3", "direction": "in", "src": "10.0.30.0 0.0.0.255", "dst": "10.0.1.10", "service": "udp/161", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/3", "acl": 110, "direction": "in", "deny_hits": 5000, "existing_rules_hint": ["deny udp 10.0.30.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit udp 10.0.30.0 0.0.0.255 host 10.0.1.10 eq 161", "exit", "interface GigabitEthernet0/3", "ip access-group 110 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "critical", "acl": 100, "interface": "Vlan20", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan20", "acl": 100, "direction": "out", "misconfig_type": "direction", "symptom": "unexpected permit"}], "cli_fix": ["interface Vlan20", "no ip access-group 100 in", "no ip access-group 100 out", "ip access-group 100 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 120, "interface": "Vlan99", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan99", "acl": 120, "direction": "out", "deny_rate": 500, "top_source": "172.16.10.0 0.0.0.63", "top_dest": "198.51.100.10", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 120", "permit tcp 172.16.10.0 0.0.0.63 host 198.51.100.10 eq 443", "exit", "interface Vlan99", "ip access-group 120 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 150, "interface": "GigabitEthernet0/1", "direction": "in", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "acl": 150, "direction": "in", "deny_rate": 1200, "top_source": "192.168.1.0 0.0.0.255", "top_dest": "198.51.100.10", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 150", "permit tcp 192.168.1.0 0.0.0.255 host 198.51.100.10 eq 23", "exit", "interface GigabitEthernet0/1", "ip access-group 150 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 101, "interface": "Vlan99", "direction": "out", "src": "10.0.40.0 0.0.255.255", "dst": "192.0.2.25", "service": "udp/123", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan99", "acl": 101, "direction": "out", "deny_hits": 5000, "existing_rules_hint": ["deny udp 10.0.40.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 101", "permit udp 10.0.40.0 0.0.255.255 host 192.0.2.25 eq 123", "exit", "interface Vlan99", "ip access-group 101 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "critical", "acl": 120, "interface": "Vlan50", "direction": "in", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan50", "acl": 120, "direction": "in", "misconfig_type": "protocol", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 120", "no deny tcp 10.0.10.0 0.0.255.255 host 10.0.3.30 eq 80", "deny udp 10.0.10.0 0.0.255.255 host 10.0.3.30 eq 80", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "high", "acl": 120, "interface": "GigabitEthernet0/3", "direction": "in", "src": "10.0.10.0 0.0.0.63", "dst": "198.51.100.10", "service": "udp/23", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "acl": 120, "direction": "in", "deny_hits": 1200, "existing_rules_hint": ["deny udp 10.0.10.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 120", "permit udp 10.0.10.0 0.0.0.63 host 198.51.100.10 eq 23", "exit", "interface GigabitEthernet0/3", "ip access-group 120 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 110, "interface": "Vlan99", "direction": "in", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan99", "acl": 110, "direction": "in", "deny_rate": 5000, "top_source": "10.0.30.0 0.0.0.255", "top_dest": "192.0.2.25", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 110", "deny tcp 10.0.30.0 0.0.0.255 host 192.0.2.25", "exit", "interface Vlan99", "ip access-group 110 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "high", "acl": 150, "interface": "Vlan50", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan50", "acl": 150, "direction": "in", "deny_rate": 5000, "top_source": "10.0.40.0 0.0.0.15", "top_dest": "192.0.2.25", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 150", "permit tcp 10.0.40.0 0.0.0.15 host 192.0.2.25 eq 514", "exit", "interface Vlan50", "ip access-group 150 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 110, "interface": "Vlan40", "direction": "in", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan40", "acl": 110, "direction": "in", "deny_rate": 1200, "top_source": "10.0.20.0 0.0.0.15", "top_dest": "192.0.2.25", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 110", "permit tcp 10.0.20.0 0.0.0.15 host 192.0.2.25 eq 443", "exit", "interface Vlan40", "ip access-group 110 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "medium", "acl": 199, "interface": "Vlan40", "direction": "in", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan40", "acl": 199, "direction": "in", "misconfig_type": "wildcard", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 199", "no deny tcp 10.0.20.0 0.0.0.255 host 203.0.113.50 eq 22", "deny tcp 10.0.20.0 0.0.0.15 host 203.0.113.50 eq 22", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "critical", "acl": 101, "interface": "GigabitEthernet0/1", "direction": "in", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "acl": 101, "direction": "in", "misconfig_type": "protocol", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 101", "no deny tcp 10.0.20.0 0.0.0.15 host 10.0.1.10 eq 80", "deny udp 10.0.20.0 0.0.0.15 host 10.0.1.10 eq 80", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "high", "acl": 101, "interface": "Vlan40", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan40", "acl": 101, "direction": "in", "deny_rate": 1200, "top_source": "10.0.40.0 0.0.0.255", "top_dest": "198.51.100.10", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 101", "deny tcp 10.0.40.0 0.0.0.255 host 198.51.100.10", "exit", "interface Vlan40", "ip access-group 101 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 120, "interface": "Vlan30", "direction": "in", "src": "192.168.1.0 0.0.0.15", "dst": "10.0.2.20", "service": "udp/443", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan30", "acl": 120, "direction": "in", "deny_hits": 200, "existing_rules_hint": ["deny udp 192.168.1.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 120", "permit udp 192.168.1.0 0.0.0.15 host 10.0.2.20 eq 443", "exit", "interface Vlan30", "ip access-group 120 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 150, "interface": "Vlan20", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan20", "acl": 150, "direction": "in", "deny_rate": 5000, "top_source": "10.0.40.0 0.0.0.63", "top_dest": "198.51.100.10", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 150", "deny udp 10.0.40.0 0.0.0.63 host 198.51.100.10", "exit", "interface Vlan20", "ip access-group 150 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "critical", "acl": 199, "interface": "GigabitEthernet0/0", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "acl": 199, "direction": "out", "misconfig_type": "direction", "symptom": "policy not applied"}], "cli_fix": ["interface GigabitEthernet0/0", "no ip access-group 199 in", "no ip access-group 199 out", "ip access-group 199 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "medium", "acl": 100, "interface": "GigabitEthernet0/2", "direction": "in", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "acl": 100, "direction": "in", "misconfig_type": "direction", "symptom": "policy not applied"}], "cli_fix": ["interface GigabitEthernet0/2", "no ip access-group 100 in", "no ip access-group 100 out", "ip access-group 100 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "high", "acl": 150, "interface": "GigabitEthernet0/2", "direction": "in", "src": "10.0.30.0 0.0.0.255", "dst": "198.51.100.10", "service": "tcp/123", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/2", "acl": 150, "direction": "in", "deny_hits": 200, "existing_rules_hint": ["deny tcp 10.0.30.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 150", "permit tcp 10.0.30.0 0.0.0.255 host 198.51.100.10 eq 123", "exit", "interface GigabitEthernet0/2", "ip access-group 150 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "critical", "acl": 100, "interface": "GigabitEthernet0/2", "direction": "out", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/2", "acl": 100, "direction": "out", "misconfig_type": "protocol", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 100", "no deny tcp 10.0.10.0 0.0.0.255 host 198.51.100.10 eq 514", "deny udp 10.0.10.0 0.0.0.255 host 198.51.100.10 eq 514", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "high", "acl": 101, "interface": "Vlan20", "direction": "out", "src": "192.168.1.0 0.0.0.63", "dst": "192.0.2.25", "service": "tcp/23", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan20", "acl": 101, "direction": "out", "deny_hits": 200, "existing_rules_hint": ["deny tcp 192.168.1.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 101", "permit tcp 192.168.1.0 0.0.0.63 host 192.0.2.25 eq 23", "exit", "interface Vlan20", "ip access-group 101 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "high", "acl": 101, "interface": "Vlan99", "direction": "out", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan99", "acl": 101, "direction": "out", "misconfig_type": "protocol", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 101", "no deny udp 172.16.10.0 0.0.0.15 host 10.0.3.30 eq 3389", "deny tcp 172.16.10.0 0.0.0.15 host 10.0.3.30 eq 3389", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "medium", "acl": 150, "interface": "Vlan20", "direction": "in", "src": "10.0.30.0 0.0.0.15", "dst": "10.0.3.30", "service": "udp/123", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan20", "acl": 150, "direction": "in", "deny_hits": 200, "existing_rules_hint": ["deny udp 10.0.30.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 150", "permit udp 10.0.30.0 0.0.0.15 host 10.0.3.30 eq 123", "exit", "interface Vlan20", "ip access-group 150 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 100, "interface": "Vlan99", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan99", "acl": 100, "direction": "out", "deny_rate": 200, "top_source": "172.16.10.0 0.0.0.255", "top_dest": "192.0.2.25", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 100", "permit tcp 172.16.10.0 0.0.0.255 host 192.0.2.25 eq 514", "exit", "interface Vlan99", "ip access-group 100 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "high", "acl": 100, "interface": "GigabitEthernet0/3", "direction": "in", "src": "10.0.30.0 0.0.255.255", "dst": "203.0.113.50", "service": "tcp/80", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "acl": 100, "direction": "in", "deny_hits": 500, "existing_rules_hint": ["deny tcp 10.0.30.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 100", "permit tcp 10.0.30.0 0.0.255.255 host 203.0.113.50 eq 80", "exit", "interface GigabitEthernet0/3", "ip access-group 100 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "high", "acl": 199, "interface": "Vlan40", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan40", "acl": 199, "direction": "in", "deny_rate": 200, "top_source": "192.168.1.0 0.0.0.63", "top_dest": "10.0.1.10", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 199", "deny icmp 192.168.1.0 0.0.0.63 host 10.0.1.10", "exit", "interface Vlan40", "ip access-group 199 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "medium", "acl": 199, "interface": "Vlan20", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan20", "acl": 199, "direction": "in", "deny_rate": 1200, "top_source": "10.0.30.0 0.0.0.255", "top_dest": "10.0.1.10", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 199", "permit tcp 10.0.30.0 0.0.0.255 host 10.0.1.10 eq 161", "exit", "interface Vlan20", "ip access-group 199 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "high", "acl": 120, "interface": "Vlan99", "direction": "out", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan99", "acl": 120, "direction": "out", "deny_rate": 5000, "top_source": "172.16.10.0 0.0.255.255", "top_dest": "10.0.3.30", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 120", "permit tcp 172.16.10.0 0.0.255.255 host 10.0.3.30 eq 161", "exit", "interface Vlan99", "ip access-group 120 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "high", "acl": 100, "interface": "GigabitEthernet0/2", "direction": "out", "src": "10.0.10.0 0.0.0.15", "dst": "10.0.3.30", "service": "tcp/123", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "acl": 100, "direction": "out", "deny_hits": 500, "existing_rules_hint": ["deny tcp 10.0.10.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 100", "permit tcp 10.0.10.0 0.0.0.15 host 10.0.3.30 eq 123", "exit", "interface GigabitEthernet0/2", "ip access-group 100 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "medium", "acl": 199, "interface": "Vlan20", "direction": "out", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan20", "acl": 199, "direction": "out", "misconfig_type": "wildcard", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 199", "no deny udp 10.0.40.0 0.0.0.255 host 203.0.113.50 eq 80", "deny udp 10.0.40.0 0.0.255.255 host 203.0.113.50 eq 80", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "medium", "acl": 100, "interface": "Vlan99", "direction": "in", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan99", "acl": 100, "direction": "in", "misconfig_type": "wildcard", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 100", "no deny udp 192.168.1.0 0.0.0.255 host 192.0.2.25 eq 53", "deny udp 192.168.1.0 0.0.0.63 host 192.0.2.25 eq 53", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "high", "acl": 110, "interface": "GigabitEthernet0/0", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "acl": 110, "direction": "out", "misconfig_type": "direction", "symptom": "unexpected permit"}], "cli_fix": ["interface GigabitEthernet0/0", "no ip access-group 110 in", "no ip access-group 110 out", "ip access-group 110 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "high", "acl": 100, "interface": "Vlan20", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan20", "acl": 100, "direction": "out", "misconfig_type": "direction", "symptom": "unexpected deny"}], "cli_fix": ["interface Vlan20", "no ip access-group 100 in", "no ip access-group 100 out", "ip access-group 100 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "high", "acl": 199, "interface": "Vlan40", "direction": "in", "src": "10.0.30.0 0.0.0.255", "dst": "198.51.100.10", "service": "tcp/8080", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan40", "acl": 199, "direction": "in", "deny_hits": 1200, "existing_rules_hint": ["deny tcp 10.0.30.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit tcp 10.0.30.0 0.0.0.255 host 198.51.100.10 eq 8080", "exit", "interface Vlan40", "ip access-group 199 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "high", "acl": 110, "interface": "Vlan50", "direction": "in", "src": "192.168.1.0 0.0.0.15", "dst": "192.0.2.25", "service": "udp/443", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan50", "acl": 110, "direction": "in", "deny_hits": 200, "existing_rules_hint": ["deny udp 192.168.1.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit udp 192.168.1.0 0.0.0.15 host 192.0.2.25 eq 443", "exit", "interface Vlan50", "ip access-group 110 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 199, "interface": "Vlan30", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan30", "acl": 199, "direction": "out", "deny_rate": 5000, "top_source": "192.168.1.0 0.0.0.15", "top_dest": "198.51.100.10", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 199", "permit tcp 192.168.1.0 0.0.0.15 host 198.51.100.10 eq 123", "exit", "interface Vlan30", "ip access-group 199 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "medium", "acl": 120, "interface": "Vlan40", "direction": "in", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan40", "acl": 120, "direction": "in", "misconfig_type": "wildcard", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 120", "no deny udp 172.16.10.0 0.0.0.15 host 10.0.3.30 eq 53", "deny udp 172.16.10.0 0.0.255.255 host 10.0.3.30 eq 53", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "high", "acl": 199, "interface": "GigabitEthernet0/0", "direction": "in", "src": "10.0.10.0 0.0.255.255", "dst": "10.0.1.10", "service": "tcp/23", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/0", "acl": 199, "direction": "in", "deny_hits": 5000, "existing_rules_hint": ["deny tcp 10.0.10.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit tcp 10.0.10.0 0.0.255.255 host 10.0.1.10 eq 23", "exit", "interface GigabitEthernet0/0", "ip access-group 199 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "high", "acl": 100, "interface": "Vlan30", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan30", "acl": 100, "direction": "out", "deny_rate": 1200, "top_source": "10.0.20.0 0.0.255.255", "top_dest": "10.0.3.30", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 100", "deny tcp 10.0.20.0 0.0.255.255 host 10.0.3.30", "exit", "interface Vlan30", "ip access-group 100 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "medium", "acl": 100, "interface": "Vlan10", "direction": "in", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan10", "acl": 100, "direction": "in", "misconfig_type": "protocol", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 100", "no deny tcp 10.0.10.0 0.0.255.255 host 203.0.113.50 eq 8080", "deny udp 10.0.10.0 0.0.255.255 host 203.0.113.50 eq 8080", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "medium", "acl": 100, "interface": "Vlan40", "direction": "in", "src": "172.16.10.0 0.0.0.15", "dst": "10.0.1.10", "service": "tcp/53", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan40", "acl": 100, "direction": "in", "deny_hits": 5000, "existing_rules_hint": ["deny tcp 172.16.10.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 100", "permit tcp 172.16.10.0 0.0.0.15 host 10.0.1.10 eq 53", "exit", "interface Vlan40", "ip access-group 100 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "high", "acl": 120, "interface": "GigabitEthernet0/3", "direction": "out", "src": "172.16.10.0 0.0.0.15", "dst": "203.0.113.50", "service": "tcp/53", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/3", "acl": 120, "direction": "out", "deny_hits": 1200, "existing_rules_hint": ["deny tcp 172.16.10.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 120", "permit tcp 172.16.10.0 0.0.0.15 host 203.0.113.50 eq 53", "exit", "interface GigabitEthernet0/3", "ip access-group 120 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "medium", "acl": 110, "interface": "GigabitEthernet0/2", "direction": "in", "src": "10.0.30.0 0.0.0.255", "dst": "203.0.113.50", "service": "tcp/23", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/2", "acl": 110, "direction": "in", "deny_hits": 5000, "existing_rules_hint": ["deny tcp 10.0.30.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit tcp 10.0.30.0 0.0.0.255 host 203.0.113.50 eq 23", "exit", "interface GigabitEthernet0/2", "ip access-group 110 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "high", "acl": 199, "interface": "GigabitEthernet0/0", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/0", "acl": 199, "direction": "out", "misconfig_type": "direction", "symptom": "unexpected deny"}], "cli_fix": ["interface GigabitEthernet0/0", "no ip access-group 199 in", "no ip access-group 199 out", "ip access-group 199 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "medium", "acl": 120, "interface": "Vlan99", "direction": "out", "src": "10.0.30.0 0.0.0.255", "dst": "10.0.3.30", "service": "tcp/80", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan99", "acl": 120, "direction": "out", "deny_hits": 200, "existing_rules_hint": ["deny tcp 10.0.30.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 120", "permit tcp 10.0.30.0 0.0.0.255 host 10.0.3.30 eq 80", "exit", "interface Vlan99", "ip access-group 120 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "high", "acl": 120, "interface": "Vlan30", "direction": "out", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan30", "acl": 120, "direction": "out", "deny_rate": 1200, "top_source": "192.168.1.0 0.0.0.15", "top_dest": "10.0.3.30", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 120", "deny udp 192.168.1.0 0.0.0.15 host 10.0.3.30", "exit", "interface Vlan30", "ip access-group 120 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "high", "acl": 101, "interface": "GigabitEthernet0/2", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "acl": 101, "direction": "in", "deny_rate": 200, "top_source": "192.168.1.0 0.0.255.255", "top_dest": "10.0.1.10", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 101", "deny icmp 192.168.1.0 0.0.255.255 host 10.0.1.10", "exit", "interface GigabitEthernet0/2", "ip access-group 101 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "high", "acl": 101, "interface": "Vlan99", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan99", "acl": 101, "direction": "in", "deny_rate": 200, "top_source": "10.0.20.0 0.0.0.63", "top_dest": "10.0.1.10", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 101", "deny icmp 10.0.20.0 0.0.0.63 host 10.0.1.10", "exit", "interface Vlan99", "ip access-group 101 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "medium", "acl": 110, "interface": "GigabitEthernet0/2", "direction": "in", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "acl": 110, "direction": "in", "misconfig_type": "wildcard", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 110", "no deny udp 10.0.10.0 0.0.0.255 host 198.51.100.10 eq 443", "deny udp 10.0.10.0 0.0.0.63 host 198.51.100.10 eq 443", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "medium", "acl": 199, "interface": "Vlan99", "direction": "out", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan99", "acl": 199, "direction": "out", "misconfig_type": "protocol", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 199", "no deny tcp 10.0.30.0 0.0.0.63 host 203.0.113.50 eq 23", "deny udp 10.0.30.0 0.0.0.63 host 203.0.113.50 eq 23", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "critical", "acl": 120, "interface": "GigabitEthernet0/2", "direction": "out", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "acl": 120, "direction": "out", "misconfig_type": "protocol", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 120", "no deny udp 10.0.10.0 0.0.0.15 host 198.51.100.10 eq 80", "deny tcp 10.0.10.0 0.0.0.15 host 198.51.100.10 eq 80", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "high", "acl": 120, "interface": "GigabitEthernet0/0", "direction": "in", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "acl": 120, "direction": "in", "misconfig_type": "direction", "symptom": "unexpected permit"}], "cli_fix": ["interface GigabitEthernet0/0", "no ip access-group 120 in", "no ip access-group 120 out", "ip access-group 120 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "high", "acl": 120, "interface": "Vlan50", "direction": "out", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan50", "acl": 120, "direction": "out", "deny_rate": 500, "top_source": "10.0.30.0 0.0.0.15", "top_dest": "10.0.1.10", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 120", "permit tcp 10.0.30.0 0.0.0.15 host 10.0.1.10 eq 53", "exit", "interface Vlan50", "ip access-group 120 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "medium", "acl": 199, "interface": "Vlan20", "direction": "out", "src": "10.0.20.0 0.0.0.63", "dst": "198.51.100.10", "service": "tcp/8080", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan20", "acl": 199, "direction": "out", "deny_hits": 1200, "existing_rules_hint": ["deny tcp 10.0.20.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit tcp 10.0.20.0 0.0.0.63 host 198.51.100.10 eq 8080", "exit", "interface Vlan20", "ip access-group 199 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "medium", "acl": 199, "interface": "GigabitEthernet0/2", "direction": "in", "src": "10.0.10.0 0.0.0.63", "dst": "203.0.113.50", "service": "udp/23", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/2", "acl": 199, "direction": "in", "deny_hits": 5000, "existing_rules_hint": ["deny udp 10.0.10.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit udp 10.0.10.0 0.0.0.63 host 203.0.113.50 eq 23", "exit", "interface GigabitEthernet0/2", "ip access-group 199 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "high", "acl": 120, "interface": "Vlan10", "direction": "out", "src": "10.0.20.0 0.0.0.15", "dst": "10.0.3.30", "service": "tcp/514", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan10", "acl": 120, "direction": "out", "deny_hits": 1200, "existing_rules_hint": ["deny tcp 10.0.20.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 120", "permit tcp 10.0.20.0 0.0.0.15 host 10.0.3.30 eq 514", "exit", "interface Vlan10", "ip access-group 120 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 110, "interface": "GigabitEthernet0/0", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/0", "acl": 110, "direction": "out", "deny_rate": 1200, "top_source": "172.16.10.0 0.0.0.15", "top_dest": "10.0.2.20", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 110", "permit tcp 172.16.10.0 0.0.0.15 host 10.0.2.20 eq 53", "exit", "interface GigabitEthernet0/0", "ip access-group 110 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "high", "acl": 100, "interface": "Vlan10", "direction": "in", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan10", "acl": 100, "direction": "in", "misconfig_type": "protocol", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 100", "no deny udp 10.0.40.0 0.0.255.255 host 10.0.1.10 eq 8080", "deny tcp 10.0.40.0 0.0.255.255 host 10.0.1.10 eq 8080", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "medium", "acl": 100, "interface": "GigabitEthernet0/2", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "acl": 100, "direction": "out", "deny_rate": 200, "top_source": "10.0.40.0 0.0.0.255", "top_dest": "10.0.3.30", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 100", "deny udp 10.0.40.0 0.0.0.255 host 10.0.3.30", "exit", "interface GigabitEthernet0/2", "ip access-group 100 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "high", "acl": 199, "interface": "Vlan99", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan99", "acl": 199, "direction": "out", "deny_rate": 5000, "top_source": "192.168.1.0 0.0.0.15", "top_dest": "10.0.1.10", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 199", "permit tcp 192.168.1.0 0.0.0.15 host 10.0.1.10 eq 23", "exit", "interface Vlan99", "ip access-group 199 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "high", "acl": 101, "interface": "GigabitEthernet0/2", "direction": "in", "src": "192.168.1.0 0.0.0.15", "dst": "10.0.3.30", "service": "tcp/80", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "acl": 101, "direction": "in", "deny_hits": 500, "existing_rules_hint": ["deny tcp 192.168.1.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 101", "permit tcp 192.168.1.0 0.0.0.15 host 10.0.3.30 eq 80", "exit", "interface GigabitEthernet0/2", "ip access-group 101 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 150, "interface": "Vlan50", "direction": "out", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan50", "acl": 150, "direction": "out", "deny_rate": 500, "top_source": "172.16.10.0 0.0.0.255", "top_dest": "10.0.1.10", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 150", "deny udp 172.16.10.0 0.0.0.255 host 10.0.1.10", "exit", "interface Vlan50", "ip access-group 150 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "medium", "acl": 199, "interface": "Vlan50", "direction": "out", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan50", "acl": 199, "direction": "out", "deny_rate": 1200, "top_source": "172.16.10.0 0.0.0.255", "top_dest": "198.51.100.10", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 199", "deny icmp 172.16.10.0 0.0.0.255 host 198.51.100.10", "exit", "interface Vlan50", "ip access-group 199 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "high", "acl": 150, "interface": "Vlan99", "direction": "out", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan99", "acl": 150, "direction": "out", "deny_rate": 500, "top_source": "10.0.40.0 0.0.0.15", "top_dest": "203.0.113.50", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 150", "deny tcp 10.0.40.0 0.0.0.15 host 203.0.113.50", "exit", "interface Vlan99", "ip access-group 150 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "high", "acl": 100, "interface": "GigabitEthernet0/1", "direction": "in", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "acl": 100, "direction": "in", "misconfig_type": "direction", "symptom": "policy not applied"}], "cli_fix": ["interface GigabitEthernet0/1", "no ip access-group 100 in", "no ip access-group 100 out", "ip access-group 100 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "medium", "acl": 100, "interface": "GigabitEthernet0/2", "direction": "out", "src": "172.16.10.0 0.0.255.255", "dst": "10.0.1.10", "service": "udp/3389", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "acl": 100, "direction": "out", "deny_hits": 1200, "existing_rules_hint": ["deny udp 172.16.10.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 100", "permit udp 172.16.10.0 0.0.255.255 host 10.0.1.10 eq 3389", "exit", "interface GigabitEthernet0/2", "ip access-group 100 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 150, "interface": "Vlan30", "direction": "in", "src": "192.168.1.0 0.0.0.255", "dst": "192.0.2.25", "service": "udp/3389", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan30", "acl": 150, "direction": "in", "deny_hits": 500, "existing_rules_hint": ["deny udp 192.168.1.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 150", "permit udp 192.168.1.0 0.0.0.255 host 192.0.2.25 eq 3389", "exit", "interface Vlan30", "ip access-group 150 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "high", "acl": 101, "interface": "GigabitEthernet0/0", "direction": "in", "src": "10.0.30.0 0.0.255.255", "dst": "10.0.2.20", "service": "udp/161", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "acl": 101, "direction": "in", "deny_hits": 200, "existing_rules_hint": ["deny udp 10.0.30.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 101", "permit udp 10.0.30.0 0.0.255.255 host 10.0.2.20 eq 161", "exit", "interface GigabitEthernet0/0", "ip access-group 101 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 199, "interface": "Vlan99", "direction": "out", "src": "10.0.30.0 0.0.0.63", "dst": "198.51.100.10", "service": "udp/80", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan99", "acl": 199, "direction": "out", "deny_hits": 500, "existing_rules_hint": ["deny udp 10.0.30.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit udp 10.0.30.0 0.0.0.63 host 198.51.100.10 eq 80", "exit", "interface Vlan99", "ip access-group 199 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "high", "acl": 101, "interface": "GigabitEthernet0/3", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/3", "acl": 101, "direction": "out", "deny_rate": 500, "top_source": "172.16.10.0 0.0.0.63", "top_dest": "10.0.3.30", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 101", "permit tcp 172.16.10.0 0.0.0.63 host 10.0.3.30 eq 161", "exit", "interface GigabitEthernet0/3", "ip access-group 101 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 101, "interface": "GigabitEthernet0/0", "direction": "out", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/0", "acl": 101, "direction": "out", "deny_rate": 200, "top_source": "172.16.10.0 0.0.255.255", "top_dest": "10.0.3.30", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 101", "deny udp 172.16.10.0 0.0.255.255 host 10.0.3.30", "exit", "interface GigabitEthernet0/0", "ip access-group 101 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "medium", "acl": 199, "interface": "Vlan50", "direction": "out", "src": "10.0.40.0 0.0.0.15", "dst": "192.0.2.25", "service": "tcp/514", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan50", "acl": 199, "direction": "out", "deny_hits": 200, "existing_rules_hint": ["deny tcp 10.0.40.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit tcp 10.0.40.0 0.0.0.15 host 192.0.2.25 eq 514", "exit", "interface Vlan50", "ip access-group 199 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "medium", "acl": 150, "interface": "Vlan99", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan99", "acl": 150, "direction": "out", "misconfig_type": "direction", "symptom": "unexpected deny"}], "cli_fix": ["interface Vlan99", "no ip access-group 150 in", "no ip access-group 150 out", "ip access-group 150 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "high", "acl": 150, "interface": "GigabitEthernet0/1", "direction": "out", "src": "10.0.10.0 0.0.0.63", "dst": "10.0.3.30", "service": "tcp/22", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "acl": 150, "direction": "out", "deny_hits": 200, "existing_rules_hint": ["deny tcp 10.0.10.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 150", "permit tcp 10.0.10.0 0.0.0.63 host 10.0.3.30 eq 22", "exit", "interface GigabitEthernet0/1", "ip access-group 150 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 120, "interface": "GigabitEthernet0/2", "direction": "in", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "acl": 120, "direction": "in", "deny_rate": 5000, "top_source": "10.0.20.0 0.0.255.255", "top_dest": "10.0.1.10", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 120", "deny tcp 10.0.20.0 0.0.255.255 host 10.0.1.10", "exit", "interface GigabitEthernet0/2", "ip access-group 120 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "high", "acl": 199, "interface": "GigabitEthernet0/3", "direction": "in", "src": "10.0.40.0 0.0.0.255", "dst": "203.0.113.50", "service": "udp/443", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/3", "acl": 199, "direction": "in", "deny_hits": 500, "existing_rules_hint": ["deny udp 10.0.40.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit udp 10.0.40.0 0.0.0.255 host 203.0.113.50 eq 443", "exit", "interface GigabitEthernet0/3", "ip access-group 199 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "high", "acl": 100, "interface": "GigabitEthernet0/1", "direction": "in", "src": "10.0.30.0 0.0.0.15", "dst": "10.0.1.10", "service": "tcp/161", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "acl": 100, "direction": "in", "deny_hits": 200, "existing_rules_hint": ["deny tcp 10.0.30.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 100", "permit tcp 10.0.30.0 0.0.0.15 host 10.0.1.10 eq 161", "exit", "interface GigabitEthernet0/1", "ip access-group 100 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "medium", "acl": 101, "interface": "Vlan10", "direction": "out", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan10", "acl": 101, "direction": "out", "misconfig_type": "wildcard", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 101", "no deny udp 10.0.30.0 0.0.0.63 host 10.0.3.30 eq 22", "deny udp 10.0.30.0 0.0.255.255 host 10.0.3.30 eq 22", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "medium", "acl": 199, "interface": "GigabitEthernet0/3", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/3", "acl": 199, "direction": "out", "misconfig_type": "direction", "symptom": "unexpected deny"}], "cli_fix": ["interface GigabitEthernet0/3", "no ip access-group 199 in", "no ip access-group 199 out", "ip access-group 199 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 150, "interface": "GigabitEthernet0/0", "direction": "in", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/0", "acl": 150, "direction": "in", "deny_rate": 1200, "top_source": "10.0.10.0 0.0.0.255", "top_dest": "10.0.3.30", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 150", "deny tcp 10.0.10.0 0.0.0.255 host 10.0.3.30", "exit", "interface GigabitEthernet0/0", "ip access-group 150 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "critical", "acl": 199, "interface": "Vlan30", "direction": "in", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan30", "acl": 199, "direction": "in", "misconfig_type": "wildcard", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 199", "no deny tcp 10.0.30.0 0.0.0.255 host 198.51.100.10 eq 514", "deny tcp 10.0.30.0 0.0.0.15 host 198.51.100.10 eq 514", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "high", "acl": 110, "interface": "Vlan99", "direction": "in", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan99", "acl": 110, "direction": "in", "misconfig_type": "protocol", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 110", "no deny udp 10.0.40.0 0.0.0.15 host 192.0.2.25 eq 53", "deny tcp 10.0.40.0 0.0.0.15 host 192.0.2.25 eq 53", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "high", "acl": 199, "interface": "Vlan40", "direction": "in", "src": "10.0.30.0 0.0.0.15", "dst": "10.0.2.20", "service": "tcp/123", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan40", "acl": 199, "direction": "in", "deny_hits": 500, "existing_rules_hint": ["deny tcp 10.0.30.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit tcp 10.0.30.0 0.0.0.15 host 10.0.2.20 eq 123", "exit", "interface Vlan40", "ip access-group 199 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "high", "acl": 110, "interface": "Vlan30", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan30", "acl": 110, "direction": "in", "deny_rate": 500, "top_source": "10.0.40.0 0.0.0.15", "top_dest": "198.51.100.10", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 110", "deny udp 10.0.40.0 0.0.0.15 host 198.51.100.10", "exit", "interface Vlan30", "ip access-group 110 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "high", "acl": 150, "interface": "GigabitEthernet0/0", "direction": "in", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "acl": 150, "direction": "in", "deny_rate": 5000, "top_source": "172.16.10.0 0.0.0.255", "top_dest": "10.0.1.10", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 150", "permit tcp 172.16.10.0 0.0.0.255 host 10.0.1.10 eq 80", "exit", "interface GigabitEthernet0/0", "ip access-group 150 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 120, "interface": "Vlan40", "direction": "in", "src": "10.0.10.0 0.0.0.15", "dst": "198.51.100.10", "service": "udp/3389", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan40", "acl": 120, "direction": "in", "deny_hits": 500, "existing_rules_hint": ["deny udp 10.0.10.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 120", "permit udp 10.0.10.0 0.0.0.15 host 198.51.100.10 eq 3389", "exit", "interface Vlan40", "ip access-group 120 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "high", "acl": 100, "interface": "GigabitEthernet0/0", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/0", "acl": 100, "direction": "out", "deny_rate": 500, "top_source": "192.168.1.0 0.0.0.15", "top_dest": "198.51.100.10", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 100", "permit tcp 192.168.1.0 0.0.0.15 host 198.51.100.10 eq 161", "exit", "interface GigabitEthernet0/0", "ip access-group 100 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "high", "acl": 101, "interface": "Vlan50", "direction": "out", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan50", "acl": 101, "direction": "out", "deny_rate": 500, "top_source": "192.168.1.0 0.0.0.255", "top_dest": "10.0.1.10", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 101", "permit tcp 192.168.1.0 0.0.0.255 host 10.0.1.10 eq 3389", "exit", "interface Vlan50", "ip access-group 101 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 150, "interface": "GigabitEthernet0/2", "direction": "out", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "acl": 150, "direction": "out", "deny_rate": 1200, "top_source": "10.0.10.0 0.0.255.255", "top_dest": "10.0.3.30", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 150", "permit tcp 10.0.10.0 0.0.255.255 host 10.0.3.30 eq 8080", "exit", "interface GigabitEthernet0/2", "ip access-group 150 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "medium", "acl": 120, "interface": "Vlan99", "direction": "in", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan99", "acl": 120, "direction": "in", "deny_rate": 200, "top_source": "192.168.1.0 0.0.255.255", "top_dest": "10.0.1.10", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 120", "permit tcp 192.168.1.0 0.0.255.255 host 10.0.1.10 eq 53", "exit", "interface Vlan99", "ip access-group 120 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "high", "acl": 110, "interface": "Vlan99", "direction": "out", "src": "192.168.1.0 0.0.255.255", "dst": "10.0.3.30", "service": "udp/514", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan99", "acl": 110, "direction": "out", "deny_hits": 5000, "existing_rules_hint": ["deny udp 192.168.1.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit udp 192.168.1.0 0.0.255.255 host 10.0.3.30 eq 514", "exit", "interface Vlan99", "ip access-group 110 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "medium", "acl": 120, "interface": "GigabitEthernet0/1", "direction": "in", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "acl": 120, "direction": "in", "misconfig_type": "direction", "symptom": "unexpected permit"}], "cli_fix": ["interface GigabitEthernet0/1", "no ip access-group 120 in", "no ip access-group 120 out", "ip access-group 120 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "high", "acl": 100, "interface": "GigabitEthernet0/3", "direction": "out", "src": "10.0.40.0 0.0.0.255", "dst": "203.0.113.50", "service": "udp/514", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/3", "acl": 100, "direction": "out", "deny_hits": 200, "existing_rules_hint": ["deny udp 10.0.40.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 100", "permit udp 10.0.40.0 0.0.0.255 host 203.0.113.50 eq 514", "exit", "interface GigabitEthernet0/3", "ip access-group 100 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "critical", "acl": 110, "interface": "Vlan40", "direction": "out", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan40", "acl": 110, "direction": "out", "misconfig_type": "protocol", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 110", "no deny udp 10.0.20.0 0.0.255.255 host 10.0.1.10 eq 23", "deny tcp 10.0.20.0 0.0.255.255 host 10.0.1.10 eq 23", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "high", "acl": 120, "interface": "Vlan30", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan30", "acl": 120, "direction": "in", "deny_rate": 200, "top_source": "10.0.40.0 0.0.0.15", "top_dest": "192.0.2.25", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 120", "deny icmp 10.0.40.0 0.0.0.15 host 192.0.2.25", "exit", "interface Vlan30", "ip access-group 120 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 150, "interface": "Vlan40", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan40", "acl": 150, "direction": "out", "deny_rate": 5000, "top_source": "10.0.10.0 0.0.0.15", "top_dest": "192.0.2.25", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 150", "deny tcp 10.0.10.0 0.0.0.15 host 192.0.2.25", "exit", "interface Vlan40", "ip access-group 150 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "high", "acl": 120, "interface": "Vlan50", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan50", "acl": 120, "direction": "out", "deny_rate": 5000, "top_source": "10.0.20.0 0.0.0.63", "top_dest": "10.0.2.20", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 120", "permit tcp 10.0.20.0 0.0.0.63 host 10.0.2.20 eq 443", "exit", "interface Vlan50", "ip access-group 120 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "medium", "acl": 110, "interface": "Vlan30", "direction": "out", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan30", "acl": 110, "direction": "out", "deny_rate": 1200, "top_source": "192.168.1.0 0.0.0.15", "top_dest": "10.0.3.30", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 110", "deny udp 192.168.1.0 0.0.0.15 host 10.0.3.30", "exit", "interface Vlan30", "ip access-group 110 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 100, "interface": "GigabitEthernet0/1", "direction": "in", "src": "10.0.40.0 0.0.0.255", "dst": "203.0.113.50", "service": "tcp/3389", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "acl": 100, "direction": "in", "deny_hits": 1200, "existing_rules_hint": ["deny tcp 10.0.40.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 100", "permit tcp 10.0.40.0 0.0.0.255 host 203.0.113.50 eq 3389", "exit", "interface GigabitEthernet0/1", "ip access-group 100 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "high", "acl": 150, "interface": "GigabitEthernet0/2", "direction": "in", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "acl": 150, "direction": "in", "deny_rate": 200, "top_source": "172.16.10.0 0.0.0.63", "top_dest": "10.0.2.20", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 150", "permit tcp 172.16.10.0 0.0.0.63 host 10.0.2.20 eq 161", "exit", "interface GigabitEthernet0/2", "ip access-group 150 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "high", "acl": 120, "interface": "Vlan10", "direction": "in", "src": "10.0.10.0 0.0.0.15", "dst": "203.0.113.50", "service": "tcp/22", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan10", "acl": 120, "direction": "in", "deny_hits": 200, "existing_rules_hint": ["deny tcp 10.0.10.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 120", "permit tcp 10.0.10.0 0.0.0.15 host 203.0.113.50 eq 22", "exit", "interface Vlan10", "ip access-group 120 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "medium", "acl": 150, "interface": "Vlan40", "direction": "out", "src": "10.0.20.0 0.0.0.15", "dst": "192.0.2.25", "service": "udp/514", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan40", "acl": 150, "direction": "out", "deny_hits": 500, "existing_rules_hint": ["deny udp 10.0.20.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 150", "permit udp 10.0.20.0 0.0.0.15 host 192.0.2.25 eq 514", "exit", "interface Vlan40", "ip access-group 150 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "medium", "acl": 110, "interface": "GigabitEthernet0/0", "direction": "out", "src": "192.168.1.0 0.0.255.255", "dst": "198.51.100.10", "service": "udp/23", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "acl": 110, "direction": "out", "deny_hits": 5000, "existing_rules_hint": ["deny udp 192.168.1.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit udp 192.168.1.0 0.0.255.255 host 198.51.100.10 eq 23", "exit", "interface GigabitEthernet0/0", "ip access-group 110 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "medium", "acl": 120, "interface": "GigabitEthernet0/2", "direction": "out", "src": "10.0.20.0 0.0.255.255", "dst": "203.0.113.50", "service": "tcp/443", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "acl": 120, "direction": "out", "deny_hits": 5000, "existing_rules_hint": ["deny tcp 10.0.20.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 120", "permit tcp 10.0.20.0 0.0.255.255 host 203.0.113.50 eq 443", "exit", "interface GigabitEthernet0/2", "ip access-group 120 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 110, "interface": "GigabitEthernet0/2", "direction": "in", "src": "10.0.30.0 0.0.0.15", "dst": "10.0.3.30", "service": "tcp/23", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "acl": 110, "direction": "in", "deny_hits": 200, "existing_rules_hint": ["deny tcp 10.0.30.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit tcp 10.0.30.0 0.0.0.15 host 10.0.3.30 eq 23", "exit", "interface GigabitEthernet0/2", "ip access-group 110 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "high", "acl": 100, "interface": "Vlan99", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan99", "acl": 100, "direction": "out", "misconfig_type": "direction", "symptom": "unexpected deny"}], "cli_fix": ["interface Vlan99", "no ip access-group 100 in", "no ip access-group 100 out", "ip access-group 100 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "high", "acl": 101, "interface": "Vlan30", "direction": "in", "src": "10.0.20.0 0.0.0.63", "dst": "203.0.113.50", "service": "udp/161", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan30", "acl": 101, "direction": "in", "deny_hits": 500, "existing_rules_hint": ["deny udp 10.0.20.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 101", "permit udp 10.0.20.0 0.0.0.63 host 203.0.113.50 eq 161", "exit", "interface Vlan30", "ip access-group 101 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "critical", "acl": 110, "interface": "Vlan30", "direction": "in", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan30", "acl": 110, "direction": "in", "misconfig_type": "wildcard", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 110", "no deny tcp 10.0.30.0 0.0.0.15 host 10.0.2.20 eq 23", "deny tcp 10.0.30.0 0.0.255.255 host 10.0.2.20 eq 23", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "medium", "acl": 100, "interface": "GigabitEthernet0/1", "direction": "in", "src": "10.0.40.0 0.0.0.255", "dst": "10.0.1.10", "service": "tcp/161", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "acl": 100, "direction": "in", "deny_hits": 5000, "existing_rules_hint": ["deny tcp 10.0.40.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 100", "permit tcp 10.0.40.0 0.0.0.255 host 10.0.1.10 eq 161", "exit", "interface GigabitEthernet0/1", "ip access-group 100 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 101, "interface": "Vlan30", "direction": "out", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan30", "acl": 101, "direction": "out", "deny_rate": 5000, "top_source": "172.16.10.0 0.0.0.255", "top_dest": "10.0.1.10", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 101", "deny tcp 172.16.10.0 0.0.0.255 host 10.0.1.10", "exit", "interface Vlan30", "ip access-group 101 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "high", "acl": 110, "interface": "GigabitEthernet0/3", "direction": "out", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "acl": 110, "direction": "out", "deny_rate": 200, "top_source": "10.0.40.0 0.0.0.63", "top_dest": "10.0.1.10", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 110", "permit tcp 10.0.40.0 0.0.0.63 host 10.0.1.10 eq 22", "exit", "interface GigabitEthernet0/3", "ip access-group 110 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "medium", "acl": 101, "interface": "Vlan10", "direction": "out", "src": "10.0.30.0 0.0.0.15", "dst": "10.0.2.20", "service": "udp/80", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan10", "acl": 101, "direction": "out", "deny_hits": 5000, "existing_rules_hint": ["deny udp 10.0.30.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 101", "permit udp 10.0.30.0 0.0.0.15 host 10.0.2.20 eq 80", "exit", "interface Vlan10", "ip access-group 101 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 100, "interface": "Vlan40", "direction": "in", "src": "10.0.40.0 0.0.0.63", "dst": "10.0.2.20", "service": "udp/161", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan40", "acl": 100, "direction": "in", "deny_hits": 5000, "existing_rules_hint": ["deny udp 10.0.40.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 100", "permit udp 10.0.40.0 0.0.0.63 host 10.0.2.20 eq 161", "exit", "interface Vlan40", "ip access-group 100 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 100, "interface": "Vlan20", "direction": "in", "src": "172.16.10.0 0.0.0.255", "dst": "10.0.1.10", "service": "tcp/161", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan20", "acl": 100, "direction": "in", "deny_hits": 1200, "existing_rules_hint": ["deny tcp 172.16.10.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 100", "permit tcp 172.16.10.0 0.0.0.255 host 10.0.1.10 eq 161", "exit", "interface Vlan20", "ip access-group 100 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "critical", "acl": 199, "interface": "GigabitEthernet0/2", "direction": "out", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/2", "acl": 199, "direction": "out", "misconfig_type": "protocol", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 199", "no deny tcp 192.168.1.0 0.0.255.255 host 192.0.2.25 eq 22", "deny udp 192.168.1.0 0.0.255.255 host 192.0.2.25 eq 22", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "critical", "acl": 100, "interface": "Vlan10", "direction": "in", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan10", "acl": 100, "direction": "in", "misconfig_type": "wildcard", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 100", "no deny tcp 192.168.1.0 0.0.0.255 host 192.0.2.25 eq 123", "deny tcp 192.168.1.0 0.0.255.255 host 192.0.2.25 eq 123", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 110, "interface": "GigabitEthernet0/2", "direction": "in", "src": "10.0.10.0 0.0.0.255", "dst": "192.0.2.25", "service": "udp/123", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "acl": 110, "direction": "in", "deny_hits": 5000, "existing_rules_hint": ["deny udp 10.0.10.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit udp 10.0.10.0 0.0.0.255 host 192.0.2.25 eq 123", "exit", "interface GigabitEthernet0/2", "ip access-group 110 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "medium", "acl": 150, "interface": "Vlan99", "direction": "in", "src": "10.0.10.0 0.0.0.63", "dst": "10.0.1.10", "service": "udp/123", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan99", "acl": 150, "direction": "in", "deny_hits": 200, "existing_rules_hint": ["deny udp 10.0.10.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 150", "permit udp 10.0.10.0 0.0.0.63 host 10.0.1.10 eq 123", "exit", "interface Vlan99", "ip access-group 150 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 120, "interface": "GigabitEthernet0/3", "direction": "in", "src": "10.0.30.0 0.0.0.255", "dst": "198.51.100.10", "service": "tcp/161", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/3", "acl": 120, "direction": "in", "deny_hits": 500, "existing_rules_hint": ["deny tcp 10.0.30.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 120", "permit tcp 10.0.30.0 0.0.0.255 host 198.51.100.10 eq 161", "exit", "interface GigabitEthernet0/3", "ip access-group 120 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 150, "interface": "Vlan99", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan99", "acl": 150, "direction": "out", "deny_rate": 1200, "top_source": "10.0.40.0 0.0.0.15", "top_dest": "10.0.2.20", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 150", "permit tcp 10.0.40.0 0.0.0.15 host 10.0.2.20 eq 8080", "exit", "interface Vlan99", "ip access-group 150 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 199, "interface": "Vlan30", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan30", "acl": 199, "direction": "in", "deny_rate": 1200, "top_source": "172.16.10.0 0.0.255.255", "top_dest": "192.0.2.25", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 199", "deny tcp 172.16.10.0 0.0.255.255 host 192.0.2.25", "exit", "interface Vlan30", "ip access-group 199 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 199, "interface": "Vlan30", "direction": "out", "src": "10.0.10.0 0.0.255.255", "dst": "192.0.2.25", "service": "tcp/3389", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan30", "acl": 199, "direction": "out", "deny_hits": 200, "existing_rules_hint": ["deny tcp 10.0.10.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit tcp 10.0.10.0 0.0.255.255 host 192.0.2.25 eq 3389", "exit", "interface Vlan30", "ip access-group 199 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "high", "acl": 110, "interface": "GigabitEthernet0/3", "direction": "out", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "acl": 110, "direction": "out", "misconfig_type": "protocol", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 110", "no deny udp 10.0.40.0 0.0.0.255 host 10.0.3.30 eq 123", "deny tcp 10.0.40.0 0.0.0.255 host 10.0.3.30 eq 123", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "high", "acl": 199, "interface": "Vlan99", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan99", "acl": 199, "direction": "out", "deny_rate": 200, "top_source": "10.0.20.0 0.0.0.255", "top_dest": "203.0.113.50", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 199", "permit tcp 10.0.20.0 0.0.0.255 host 203.0.113.50 eq 443", "exit", "interface Vlan99", "ip access-group 199 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 100, "interface": "Vlan30", "direction": "in", "src": "10.0.40.0 0.0.255.255", "dst": "10.0.3.30", "service": "tcp/443", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan30", "acl": 100, "direction": "in", "deny_hits": 5000, "existing_rules_hint": ["deny tcp 10.0.40.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 100", "permit tcp 10.0.40.0 0.0.255.255 host 10.0.3.30 eq 443", "exit", "interface Vlan30", "ip access-group 100 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "medium", "acl": 101, "interface": "Vlan50", "direction": "out", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan50", "acl": 101, "direction": "out", "deny_rate": 5000, "top_source": "10.0.20.0 0.0.0.255", "top_dest": "192.0.2.25", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 101", "deny udp 10.0.20.0 0.0.0.255 host 192.0.2.25", "exit", "interface Vlan50", "ip access-group 101 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "medium", "acl": 199, "interface": "Vlan30", "direction": "out", "src": "192.168.1.0 0.0.255.255", "dst": "192.0.2.25", "service": "tcp/23", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan30", "acl": 199, "direction": "out", "deny_hits": 5000, "existing_rules_hint": ["deny tcp 192.168.1.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit tcp 192.168.1.0 0.0.255.255 host 192.0.2.25 eq 23", "exit", "interface Vlan30", "ip access-group 199 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "critical", "acl": 110, "interface": "Vlan30", "direction": "in", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan30", "acl": 110, "direction": "in", "misconfig_type": "wildcard", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 110", "no deny tcp 10.0.20.0 0.0.255.255 host 10.0.2.20 eq 3389", "deny tcp 10.0.20.0 0.0.0.15 host 10.0.2.20 eq 3389", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "medium", "acl": 199, "interface": "GigabitEthernet0/0", "direction": "in", "src": "10.0.20.0 0.0.255.255", "dst": "10.0.2.20", "service": "tcp/3389", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "acl": 199, "direction": "in", "deny_hits": 500, "existing_rules_hint": ["deny tcp 10.0.20.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit tcp 10.0.20.0 0.0.255.255 host 10.0.2.20 eq 3389", "exit", "interface GigabitEthernet0/0", "ip access-group 199 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "high", "acl": 199, "interface": "Vlan30", "direction": "in", "src": "10.0.30.0 0.0.0.255", "dst": "192.0.2.25", "service": "udp/161", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan30", "acl": 199, "direction": "in", "deny_hits": 200, "existing_rules_hint": ["deny udp 10.0.30.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit udp 10.0.30.0 0.0.0.255 host 192.0.2.25 eq 161", "exit", "interface Vlan30", "ip access-group 199 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 150, "interface": "Vlan99", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan99", "acl": 150, "direction": "in", "deny_rate": 5000, "top_source": "10.0.10.0 0.0.0.255", "top_dest": "203.0.113.50", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 150", "permit tcp 10.0.10.0 0.0.0.255 host 203.0.113.50 eq 514", "exit", "interface Vlan99", "ip access-group 150 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "medium", "acl": 199, "interface": "GigabitEthernet0/3", "direction": "in", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/3", "acl": 199, "direction": "in", "misconfig_type": "wildcard", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 199", "no deny udp 10.0.20.0 0.0.0.15 host 198.51.100.10 eq 23", "deny udp 10.0.20.0 0.0.0.63 host 198.51.100.10 eq 23", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "medium", "acl": 120, "interface": "GigabitEthernet0/1", "direction": "in", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "acl": 120, "direction": "in", "misconfig_type": "direction", "symptom": "policy not applied"}], "cli_fix": ["interface GigabitEthernet0/1", "no ip access-group 120 in", "no ip access-group 120 out", "ip access-group 120 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "high", "acl": 150, "interface": "GigabitEthernet0/3", "direction": "in", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "acl": 150, "direction": "in", "misconfig_type": "wildcard", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 150", "no deny udp 172.16.10.0 0.0.0.255 host 192.0.2.25 eq 23", "deny udp 172.16.10.0 0.0.0.63 host 192.0.2.25 eq 23", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "critical", "acl": 199, "interface": "GigabitEthernet0/0", "direction": "in", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "acl": 199, "direction": "in", "misconfig_type": "wildcard", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 199", "no deny udp 10.0.30.0 0.0.0.255 host 10.0.1.10 eq 80", "deny udp 10.0.30.0 0.0.255.255 host 10.0.1.10 eq 80", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 110, "interface": "Vlan10", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan10", "acl": 110, "direction": "in", "deny_rate": 500, "top_source": "192.168.1.0 0.0.0.15", "top_dest": "203.0.113.50", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 110", "permit tcp 192.168.1.0 0.0.0.15 host 203.0.113.50 eq 8080", "exit", "interface Vlan10", "ip access-group 110 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "high", "acl": 150, "interface": "Vlan30", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan30", "acl": 150, "direction": "in", "deny_rate": 5000, "top_source": "10.0.40.0 0.0.0.15", "top_dest": "10.0.2.20", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 150", "deny icmp 10.0.40.0 0.0.0.15 host 10.0.2.20", "exit", "interface Vlan30", "ip access-group 150 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 150, "interface": "Vlan20", "direction": "in", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan20", "acl": 150, "direction": "in", "deny_rate": 500, "top_source": "10.0.10.0 0.0.255.255", "top_dest": "192.0.2.25", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 150", "deny tcp 10.0.10.0 0.0.255.255 host 192.0.2.25", "exit", "interface Vlan20", "ip access-group 150 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "medium", "acl": 199, "interface": "Vlan30", "direction": "in", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan30", "acl": 199, "direction": "in", "misconfig_type": "protocol", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 199", "no deny udp 10.0.20.0 0.0.0.63 host 10.0.1.10 eq 53", "deny tcp 10.0.20.0 0.0.0.63 host 10.0.1.10 eq 53", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 110, "interface": "GigabitEthernet0/0", "direction": "out", "src": "10.0.10.0 0.0.0.15", "dst": "10.0.3.30", "service": "udp/22", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "acl": 110, "direction": "out", "deny_hits": 200, "existing_rules_hint": ["deny udp 10.0.10.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit udp 10.0.10.0 0.0.0.15 host 10.0.3.30 eq 22", "exit", "interface GigabitEthernet0/0", "ip access-group 110 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "high", "acl": 101, "interface": "GigabitEthernet0/3", "direction": "out", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/3", "acl": 101, "direction": "out", "deny_rate": 5000, "top_source": "192.168.1.0 0.0.0.255", "top_dest": "203.0.113.50", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 101", "permit tcp 192.168.1.0 0.0.0.255 host 203.0.113.50 eq 3389", "exit", "interface GigabitEthernet0/3", "ip access-group 101 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 100, "interface": "Vlan10", "direction": "out", "src": "10.0.40.0 0.0.0.255", "dst": "10.0.3.30", "service": "udp/123", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan10", "acl": 100, "direction": "out", "deny_hits": 500, "existing_rules_hint": ["deny udp 10.0.40.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 100", "permit udp 10.0.40.0 0.0.0.255 host 10.0.3.30 eq 123", "exit", "interface Vlan10", "ip access-group 100 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 110, "interface": "Vlan50", "direction": "out", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan50", "acl": 110, "direction": "out", "deny_rate": 200, "top_source": "192.168.1.0 0.0.0.15", "top_dest": "192.0.2.25", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 110", "deny udp 192.168.1.0 0.0.0.15 host 192.0.2.25", "exit", "interface Vlan50", "ip access-group 110 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "medium", "acl": 110, "interface": "Vlan99", "direction": "out", "src": "172.16.10.0 0.0.0.255", "dst": "10.0.2.20", "service": "udp/443", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan99", "acl": 110, "direction": "out", "deny_hits": 500, "existing_rules_hint": ["deny udp 172.16.10.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit udp 172.16.10.0 0.0.0.255 host 10.0.2.20 eq 443", "exit", "interface Vlan99", "ip access-group 110 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 100, "interface": "GigabitEthernet0/0", "direction": "in", "src": "172.16.10.0 0.0.0.15", "dst": "203.0.113.50", "service": "udp/53", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "acl": 100, "direction": "in", "deny_hits": 5000, "existing_rules_hint": ["deny udp 172.16.10.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 100", "permit udp 172.16.10.0 0.0.0.15 host 203.0.113.50 eq 53", "exit", "interface GigabitEthernet0/0", "ip access-group 100 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 199, "interface": "GigabitEthernet0/2", "direction": "in", "src": "10.0.10.0 0.0.255.255", "dst": "10.0.3.30", "service": "udp/8080", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/2", "acl": 199, "direction": "in", "deny_hits": 500, "existing_rules_hint": ["deny udp 10.0.10.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit udp 10.0.10.0 0.0.255.255 host 10.0.3.30 eq 8080", "exit", "interface GigabitEthernet0/2", "ip access-group 199 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "high", "acl": 120, "interface": "Vlan50", "direction": "out", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan50", "acl": 120, "direction": "out", "misconfig_type": "protocol", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 120", "no deny tcp 172.16.10.0 0.0.0.63 host 10.0.1.10 eq 53", "deny udp 172.16.10.0 0.0.0.63 host 10.0.1.10 eq 53", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "high", "acl": 110, "interface": "Vlan99", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan99", "acl": 110, "direction": "in", "deny_rate": 200, "top_source": "10.0.20.0 0.0.255.255", "top_dest": "10.0.1.10", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 110", "deny udp 10.0.20.0 0.0.255.255 host 10.0.1.10", "exit", "interface Vlan99", "ip access-group 110 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "high", "acl": 120, "interface": "GigabitEthernet0/0", "direction": "out", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "acl": 120, "direction": "out", "misconfig_type": "wildcard", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 120", "no deny udp 10.0.10.0 0.0.0.63 host 198.51.100.10 eq 3389", "deny udp 10.0.10.0 0.0.0.255 host 198.51.100.10 eq 3389", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 199, "interface": "Vlan50", "direction": "in", "src": "10.0.20.0 0.0.0.15", "dst": "10.0.3.30", "service": "tcp/53", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan50", "acl": 199, "direction": "in", "deny_hits": 200, "existing_rules_hint": ["deny tcp 10.0.20.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit tcp 10.0.20.0 0.0.0.15 host 10.0.3.30 eq 53", "exit", "interface Vlan50", "ip access-group 199 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "critical", "acl": 101, "interface": "Vlan99", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan99", "acl": 101, "direction": "out", "misconfig_type": "direction", "symptom": "unexpected permit"}], "cli_fix": ["interface Vlan99", "no ip access-group 101 in", "no ip access-group 101 out", "ip access-group 101 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "high", "acl": 101, "interface": "GigabitEthernet0/1", "direction": "in", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "acl": 101, "direction": "in", "deny_rate": 500, "top_source": "10.0.30.0 0.0.0.255", "top_dest": "10.0.2.20", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 101", "deny icmp 10.0.30.0 0.0.0.255 host 10.0.2.20", "exit", "interface GigabitEthernet0/1", "ip access-group 101 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "medium", "acl": 110, "interface": "Vlan10", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan10", "acl": 110, "direction": "out", "misconfig_type": "direction", "symptom": "unexpected permit"}], "cli_fix": ["interface Vlan10", "no ip access-group 110 in", "no ip access-group 110 out", "ip access-group 110 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "medium", "acl": 150, "interface": "GigabitEthernet0/3", "direction": "out", "src": "192.168.1.0 0.0.0.255", "dst": "198.51.100.10", "service": "tcp/53", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "acl": 150, "direction": "out", "deny_hits": 5000, "existing_rules_hint": ["deny tcp 192.168.1.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 150", "permit tcp 192.168.1.0 0.0.0.255 host 198.51.100.10 eq 53", "exit", "interface GigabitEthernet0/3", "ip access-group 150 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "high", "acl": 101, "interface": "Vlan99", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan99", "acl": 101, "direction": "in", "deny_rate": 500, "top_source": "10.0.10.0 0.0.0.15", "top_dest": "10.0.3.30", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 101", "deny icmp 10.0.10.0 0.0.0.15 host 10.0.3.30", "exit", "interface Vlan99", "ip access-group 101 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "high", "acl": 110, "interface": "Vlan20", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan20", "acl": 110, "direction": "in", "deny_rate": 5000, "top_source": "10.0.30.0 0.0.0.255", "top_dest": "203.0.113.50", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 110", "permit tcp 10.0.30.0 0.0.0.255 host 203.0.113.50 eq 80", "exit", "interface Vlan20", "ip access-group 110 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "critical", "acl": 110, "interface": "Vlan30", "direction": "in", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan30", "acl": 110, "direction": "in", "misconfig_type": "direction", "symptom": "unexpected deny"}], "cli_fix": ["interface Vlan30", "no ip access-group 110 in", "no ip access-group 110 out", "ip access-group 110 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "high", "acl": 120, "interface": "Vlan99", "direction": "out", "src": "10.0.30.0 0.0.0.63", "dst": "10.0.3.30", "service": "tcp/23", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan99", "acl": 120, "direction": "out", "deny_hits": 5000, "existing_rules_hint": ["deny tcp 10.0.30.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 120", "permit tcp 10.0.30.0 0.0.0.63 host 10.0.3.30 eq 23", "exit", "interface Vlan99", "ip access-group 120 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "high", "acl": 150, "interface": "GigabitEthernet0/2", "direction": "out", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "acl": 150, "direction": "out", "misconfig_type": "wildcard", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 150", "no deny tcp 10.0.20.0 0.0.0.63 host 203.0.113.50 eq 22", "deny tcp 10.0.20.0 0.0.255.255 host 203.0.113.50 eq 22", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "medium", "acl": 100, "interface": "Vlan50", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan50", "acl": 100, "direction": "out", "misconfig_type": "direction", "symptom": "unexpected deny"}], "cli_fix": ["interface Vlan50", "no ip access-group 100 in", "no ip access-group 100 out", "ip access-group 100 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 150, "interface": "Vlan50", "direction": "in", "src": "10.0.40.0 0.0.255.255", "dst": "10.0.2.20", "service": "tcp/22", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan50", "acl": 150, "direction": "in", "deny_hits": 500, "existing_rules_hint": ["deny tcp 10.0.40.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 150", "permit tcp 10.0.40.0 0.0.255.255 host 10.0.2.20 eq 22", "exit", "interface Vlan50", "ip access-group 150 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "high", "acl": 199, "interface": "GigabitEthernet0/1", "direction": "out", "src": "172.16.10.0 0.0.255.255", "dst": "10.0.2.20", "service": "tcp/3389", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "acl": 199, "direction": "out", "deny_hits": 200, "existing_rules_hint": ["deny tcp 172.16.10.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit tcp 172.16.10.0 0.0.255.255 host 10.0.2.20 eq 3389", "exit", "interface GigabitEthernet0/1", "ip access-group 199 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 100, "interface": "Vlan50", "direction": "in", "src": "10.0.10.0 0.0.0.63", "dst": "10.0.1.10", "service": "udp/3389", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan50", "acl": 100, "direction": "in", "deny_hits": 200, "existing_rules_hint": ["deny udp 10.0.10.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 100", "permit udp 10.0.10.0 0.0.0.63 host 10.0.1.10 eq 3389", "exit", "interface Vlan50", "ip access-group 100 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "high", "acl": 199, "interface": "Vlan10", "direction": "out", "src": "10.0.20.0 0.0.0.255", "dst": "192.0.2.25", "service": "udp/53", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan10", "acl": 199, "direction": "out", "deny_hits": 500, "existing_rules_hint": ["deny udp 10.0.20.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit udp 10.0.20.0 0.0.0.255 host 192.0.2.25 eq 53", "exit", "interface Vlan10", "ip access-group 199 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "medium", "acl": 110, "interface": "Vlan40", "direction": "in", "src": "10.0.30.0 0.0.0.15", "dst": "10.0.2.20", "service": "tcp/161", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan40", "acl": 110, "direction": "in", "deny_hits": 500, "existing_rules_hint": ["deny tcp 10.0.30.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit tcp 10.0.30.0 0.0.0.15 host 10.0.2.20 eq 161", "exit", "interface Vlan40", "ip access-group 110 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 199, "interface": "Vlan10", "direction": "in", "src": "192.168.1.0 0.0.255.255", "dst": "10.0.2.20", "service": "udp/514", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan10", "acl": 199, "direction": "in", "deny_hits": 200, "existing_rules_hint": ["deny udp 192.168.1.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit udp 192.168.1.0 0.0.255.255 host 10.0.2.20 eq 514", "exit", "interface Vlan10", "ip access-group 199 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "medium", "acl": 100, "interface": "Vlan30", "direction": "out", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan30", "acl": 100, "direction": "out", "deny_rate": 200, "top_source": "10.0.10.0 0.0.255.255", "top_dest": "203.0.113.50", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 100", "permit tcp 10.0.10.0 0.0.255.255 host 203.0.113.50 eq 80", "exit", "interface Vlan30", "ip access-group 100 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "high", "acl": 100, "interface": "GigabitEthernet0/3", "direction": "out", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/3", "acl": 100, "direction": "out", "deny_rate": 5000, "top_source": "10.0.30.0 0.0.0.255", "top_dest": "203.0.113.50", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 100", "permit tcp 10.0.30.0 0.0.0.255 host 203.0.113.50 eq 161", "exit", "interface GigabitEthernet0/3", "ip access-group 100 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "high", "acl": 100, "interface": "GigabitEthernet0/2", "direction": "in", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "acl": 100, "direction": "in", "deny_rate": 500, "top_source": "10.0.30.0 0.0.0.63", "top_dest": "10.0.2.20", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 100", "deny udp 10.0.30.0 0.0.0.63 host 10.0.2.20", "exit", "interface GigabitEthernet0/2", "ip access-group 100 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "high", "acl": 120, "interface": "Vlan40", "direction": "out", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan40", "acl": 120, "direction": "out", "misconfig_type": "protocol", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 120", "no deny tcp 10.0.30.0 0.0.255.255 host 198.51.100.10 eq 8080", "deny udp 10.0.30.0 0.0.255.255 host 198.51.100.10 eq 8080", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "high", "acl": 150, "interface": "GigabitEthernet0/0", "direction": "out", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "acl": 150, "direction": "out", "misconfig_type": "protocol", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 150", "no deny tcp 172.16.10.0 0.0.0.15 host 10.0.3.30 eq 123", "deny udp 172.16.10.0 0.0.0.15 host 10.0.3.30 eq 123", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "medium", "acl": 110, "interface": "Vlan30", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan30", "acl": 110, "direction": "out", "deny_rate": 5000, "top_source": "10.0.30.0 0.0.0.15", "top_dest": "203.0.113.50", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 110", "permit tcp 10.0.30.0 0.0.0.15 host 203.0.113.50 eq 123", "exit", "interface Vlan30", "ip access-group 110 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 120, "interface": "GigabitEthernet0/3", "direction": "out", "src": "192.168.1.0 0.0.0.255", "dst": "10.0.3.30", "service": "tcp/514", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "acl": 120, "direction": "out", "deny_hits": 5000, "existing_rules_hint": ["deny tcp 192.168.1.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 120", "permit tcp 192.168.1.0 0.0.0.255 host 10.0.3.30 eq 514", "exit", "interface GigabitEthernet0/3", "ip access-group 120 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 199, "interface": "Vlan30", "direction": "out", "src": "172.16.10.0 0.0.255.255", "dst": "203.0.113.50", "service": "udp/8080", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan30", "acl": 199, "direction": "out", "deny_hits": 5000, "existing_rules_hint": ["deny udp 172.16.10.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit udp 172.16.10.0 0.0.255.255 host 203.0.113.50 eq 8080", "exit", "interface Vlan30", "ip access-group 199 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "medium", "acl": 150, "interface": "Vlan30", "direction": "in", "src": "10.0.10.0 0.0.0.15", "dst": "10.0.1.10", "service": "tcp/443", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan30", "acl": 150, "direction": "in", "deny_hits": 500, "existing_rules_hint": ["deny tcp 10.0.10.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 150", "permit tcp 10.0.10.0 0.0.0.15 host 10.0.1.10 eq 443", "exit", "interface Vlan30", "ip access-group 150 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "high", "acl": 199, "interface": "GigabitEthernet0/0", "direction": "out", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "acl": 199, "direction": "out", "misconfig_type": "wildcard", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 199", "no deny tcp 10.0.20.0 0.0.0.63 host 10.0.2.20 eq 443", "deny tcp 10.0.20.0 0.0.255.255 host 10.0.2.20 eq 443", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 120, "interface": "GigabitEthernet0/1", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "acl": 120, "direction": "in", "deny_rate": 500, "top_source": "10.0.20.0 0.0.255.255", "top_dest": "10.0.2.20", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 120", "deny udp 10.0.20.0 0.0.255.255 host 10.0.2.20", "exit", "interface GigabitEthernet0/1", "ip access-group 120 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "high", "acl": 101, "interface": "Vlan99", "direction": "out", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan99", "acl": 101, "direction": "out", "misconfig_type": "wildcard", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 101", "no deny tcp 10.0.10.0 0.0.255.255 host 203.0.113.50 eq 80", "deny tcp 10.0.10.0 0.0.0.15 host 203.0.113.50 eq 80", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "medium", "acl": 199, "interface": "Vlan20", "direction": "out", "src": "172.16.10.0 0.0.255.255", "dst": "10.0.2.20", "service": "tcp/8080", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan20", "acl": 199, "direction": "out", "deny_hits": 500, "existing_rules_hint": ["deny tcp 172.16.10.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit tcp 172.16.10.0 0.0.255.255 host 10.0.2.20 eq 8080", "exit", "interface Vlan20", "ip access-group 199 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "high", "acl": 101, "interface": "Vlan20", "direction": "out", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan20", "acl": 101, "direction": "out", "deny_rate": 1200, "top_source": "10.0.10.0 0.0.0.15", "top_dest": "10.0.2.20", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 101", "permit tcp 10.0.10.0 0.0.0.15 host 10.0.2.20 eq 80", "exit", "interface Vlan20", "ip access-group 101 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "high", "acl": 120, "interface": "GigabitEthernet0/2", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "acl": 120, "direction": "out", "deny_rate": 1200, "top_source": "192.168.1.0 0.0.0.255", "top_dest": "192.0.2.25", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 120", "deny icmp 192.168.1.0 0.0.0.255 host 192.0.2.25", "exit", "interface GigabitEthernet0/2", "ip access-group 120 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 120, "interface": "GigabitEthernet0/1", "direction": "out", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "acl": 120, "direction": "out", "deny_rate": 5000, "top_source": "10.0.40.0 0.0.255.255", "top_dest": "203.0.113.50", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 120", "deny tcp 10.0.40.0 0.0.255.255 host 203.0.113.50", "exit", "interface GigabitEthernet0/1", "ip access-group 120 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 199, "interface": "Vlan10", "direction": "out", "src": "10.0.30.0 0.0.0.63", "dst": "198.51.100.10", "service": "udp/514", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan10", "acl": 199, "direction": "out", "deny_hits": 1200, "existing_rules_hint": ["deny udp 10.0.30.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit udp 10.0.30.0 0.0.0.63 host 198.51.100.10 eq 514", "exit", "interface Vlan10", "ip access-group 199 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 101, "interface": "Vlan30", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan30", "acl": 101, "direction": "in", "deny_rate": 1200, "top_source": "192.168.1.0 0.0.0.15", "top_dest": "10.0.2.20", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 101", "permit tcp 192.168.1.0 0.0.0.15 host 10.0.2.20 eq 123", "exit", "interface Vlan30", "ip access-group 101 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "critical", "acl": 110, "interface": "Vlan40", "direction": "in", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan40", "acl": 110, "direction": "in", "misconfig_type": "direction", "symptom": "unexpected deny"}], "cli_fix": ["interface Vlan40", "no ip access-group 110 in", "no ip access-group 110 out", "ip access-group 110 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "medium", "acl": 101, "interface": "GigabitEthernet0/1", "direction": "out", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "acl": 101, "direction": "out", "misconfig_type": "wildcard", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 101", "no deny tcp 172.16.10.0 0.0.0.255 host 192.0.2.25 eq 443", "deny tcp 172.16.10.0 0.0.0.63 host 192.0.2.25 eq 443", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "medium", "acl": 150, "interface": "GigabitEthernet0/0", "direction": "in", "src": "10.0.30.0 0.0.255.255", "dst": "10.0.2.20", "service": "udp/3389", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "acl": 150, "direction": "in", "deny_hits": 5000, "existing_rules_hint": ["deny udp 10.0.30.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 150", "permit udp 10.0.30.0 0.0.255.255 host 10.0.2.20 eq 3389", "exit", "interface GigabitEthernet0/0", "ip access-group 150 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "medium", "acl": 100, "interface": "Vlan99", "direction": "out", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan99", "acl": 100, "direction": "out", "deny_rate": 5000, "top_source": "10.0.10.0 0.0.0.63", "top_dest": "10.0.3.30", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 100", "permit tcp 10.0.10.0 0.0.0.63 host 10.0.3.30 eq 80", "exit", "interface Vlan99", "ip access-group 100 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "high", "acl": 120, "interface": "Vlan20", "direction": "out", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan20", "acl": 120, "direction": "out", "deny_rate": 200, "top_source": "192.168.1.0 0.0.255.255", "top_dest": "192.0.2.25", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 120", "deny tcp 192.168.1.0 0.0.255.255 host 192.0.2.25", "exit", "interface Vlan20", "ip access-group 120 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "high", "acl": 150, "interface": "Vlan99", "direction": "in", "src": "10.0.40.0 0.0.0.15", "dst": "10.0.2.20", "service": "udp/8080", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan99", "acl": 150, "direction": "in", "deny_hits": 1200, "existing_rules_hint": ["deny udp 10.0.40.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 150", "permit udp 10.0.40.0 0.0.0.15 host 10.0.2.20 eq 8080", "exit", "interface Vlan99", "ip access-group 150 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "high", "acl": 120, "interface": "GigabitEthernet0/2", "direction": "in", "src": "172.16.10.0 0.0.0.15", "dst": "198.51.100.10", "service": "tcp/80", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "acl": 120, "direction": "in", "deny_hits": 1200, "existing_rules_hint": ["deny tcp 172.16.10.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 120", "permit tcp 172.16.10.0 0.0.0.15 host 198.51.100.10 eq 80", "exit", "interface GigabitEthernet0/2", "ip access-group 120 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 150, "interface": "Vlan30", "direction": "in", "src": "10.0.40.0 0.0.0.63", "dst": "10.0.3.30", "service": "udp/23", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan30", "acl": 150, "direction": "in", "deny_hits": 500, "existing_rules_hint": ["deny udp 10.0.40.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 150", "permit udp 10.0.40.0 0.0.0.63 host 10.0.3.30 eq 23", "exit", "interface Vlan30", "ip access-group 150 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 199, "interface": "Vlan50", "direction": "in", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan50", "acl": 199, "direction": "in", "deny_rate": 200, "top_source": "10.0.30.0 0.0.0.15", "top_dest": "192.0.2.25", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 199", "deny udp 10.0.30.0 0.0.0.15 host 192.0.2.25", "exit", "interface Vlan50", "ip access-group 199 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "medium", "acl": 150, "interface": "Vlan10", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan10", "acl": 150, "direction": "in", "deny_rate": 1200, "top_source": "172.16.10.0 0.0.0.63", "top_dest": "10.0.2.20", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 150", "permit tcp 172.16.10.0 0.0.0.63 host 10.0.2.20 eq 22", "exit", "interface Vlan10", "ip access-group 150 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "high", "acl": 101, "interface": "GigabitEthernet0/0", "direction": "out", "src": "10.0.10.0 0.0.0.15", "dst": "192.0.2.25", "service": "tcp/3389", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/0", "acl": 101, "direction": "out", "deny_hits": 500, "existing_rules_hint": ["deny tcp 10.0.10.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 101", "permit tcp 10.0.10.0 0.0.0.15 host 192.0.2.25 eq 3389", "exit", "interface GigabitEthernet0/0", "ip access-group 101 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "high", "acl": 110, "interface": "GigabitEthernet0/0", "direction": "out", "src": "10.0.20.0 0.0.0.63", "dst": "192.0.2.25", "service": "udp/514", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "acl": 110, "direction": "out", "deny_hits": 200, "existing_rules_hint": ["deny udp 10.0.20.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit udp 10.0.20.0 0.0.0.63 host 192.0.2.25 eq 514", "exit", "interface GigabitEthernet0/0", "ip access-group 110 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "high", "acl": 120, "interface": "Vlan10", "direction": "in", "src": "10.0.10.0 0.0.255.255", "dst": "192.0.2.25", "service": "udp/443", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan10", "acl": 120, "direction": "in", "deny_hits": 200, "existing_rules_hint": ["deny udp 10.0.10.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 120", "permit udp 10.0.10.0 0.0.255.255 host 192.0.2.25 eq 443", "exit", "interface Vlan10", "ip access-group 120 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "high", "acl": 101, "interface": "GigabitEthernet0/0", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "acl": 101, "direction": "out", "deny_rate": 200, "top_source": "10.0.30.0 0.0.0.15", "top_dest": "192.0.2.25", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 101", "deny icmp 10.0.30.0 0.0.0.15 host 192.0.2.25", "exit", "interface GigabitEthernet0/0", "ip access-group 101 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "high", "acl": 100, "interface": "Vlan10", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan10", "acl": 100, "direction": "out", "misconfig_type": "direction", "symptom": "policy not applied"}], "cli_fix": ["interface Vlan10", "no ip access-group 100 in", "no ip access-group 100 out", "ip access-group 100 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 110, "interface": "Vlan30", "direction": "out", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan30", "acl": 110, "direction": "out", "deny_rate": 1200, "top_source": "172.16.10.0 0.0.0.15", "top_dest": "10.0.1.10", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 110", "permit tcp 172.16.10.0 0.0.0.15 host 10.0.1.10 eq 22", "exit", "interface Vlan30", "ip access-group 110 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 199, "interface": "Vlan50", "direction": "out", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan50", "acl": 199, "direction": "out", "deny_rate": 1200, "top_source": "172.16.10.0 0.0.0.15", "top_dest": "198.51.100.10", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 199", "permit tcp 172.16.10.0 0.0.0.15 host 198.51.100.10 eq 123", "exit", "interface Vlan50", "ip access-group 199 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 100, "interface": "Vlan40", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan40", "acl": 100, "direction": "out", "deny_rate": 5000, "top_source": "172.16.10.0 0.0.0.63", "top_dest": "10.0.1.10", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 100", "permit tcp 172.16.10.0 0.0.0.63 host 10.0.1.10 eq 3389", "exit", "interface Vlan40", "ip access-group 100 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 199, "interface": "Vlan40", "direction": "out", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan40", "acl": 199, "direction": "out", "deny_rate": 500, "top_source": "10.0.40.0 0.0.0.63", "top_dest": "203.0.113.50", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 199", "permit tcp 10.0.40.0 0.0.0.63 host 203.0.113.50 eq 22", "exit", "interface Vlan40", "ip access-group 199 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "medium", "acl": 110, "interface": "GigabitEthernet0/0", "direction": "out", "src": "10.0.30.0 0.0.0.63", "dst": "192.0.2.25", "service": "udp/123", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "acl": 110, "direction": "out", "deny_hits": 5000, "existing_rules_hint": ["deny udp 10.0.30.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit udp 10.0.30.0 0.0.0.63 host 192.0.2.25 eq 123", "exit", "interface GigabitEthernet0/0", "ip access-group 110 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "high", "acl": 199, "interface": "Vlan10", "direction": "out", "src": "172.16.10.0 0.0.0.15", "dst": "10.0.2.20", "service": "udp/443", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan10", "acl": 199, "direction": "out", "deny_hits": 200, "existing_rules_hint": ["deny udp 172.16.10.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit udp 172.16.10.0 0.0.0.15 host 10.0.2.20 eq 443", "exit", "interface Vlan10", "ip access-group 199 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "high", "acl": 101, "interface": "Vlan10", "direction": "in", "src": "10.0.20.0 0.0.0.255", "dst": "10.0.3.30", "service": "tcp/514", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan10", "acl": 101, "direction": "in", "deny_hits": 5000, "existing_rules_hint": ["deny tcp 10.0.20.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 101", "permit tcp 10.0.20.0 0.0.0.255 host 10.0.3.30 eq 514", "exit", "interface Vlan10", "ip access-group 101 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "high", "acl": 100, "interface": "GigabitEthernet0/2", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/2", "acl": 100, "direction": "out", "misconfig_type": "direction", "symptom": "unexpected deny"}], "cli_fix": ["interface GigabitEthernet0/2", "no ip access-group 100 in", "no ip access-group 100 out", "ip access-group 100 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "critical", "acl": 100, "interface": "Vlan10", "direction": "in", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan10", "acl": 100, "direction": "in", "misconfig_type": "wildcard", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 100", "no deny tcp 172.16.10.0 0.0.0.63 host 10.0.3.30 eq 53", "deny tcp 172.16.10.0 0.0.255.255 host 10.0.3.30 eq 53", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "high", "acl": 110, "interface": "Vlan30", "direction": "in", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan30", "acl": 110, "direction": "in", "misconfig_type": "direction", "symptom": "policy not applied"}], "cli_fix": ["interface Vlan30", "no ip access-group 110 in", "no ip access-group 110 out", "ip access-group 110 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "medium", "acl": 120, "interface": "Vlan50", "direction": "out", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan50", "acl": 120, "direction": "out", "deny_rate": 5000, "top_source": "192.168.1.0 0.0.0.63", "top_dest": "203.0.113.50", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 120", "deny tcp 192.168.1.0 0.0.0.63 host 203.0.113.50", "exit", "interface Vlan50", "ip access-group 120 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "critical", "acl": 110, "interface": "Vlan10", "direction": "out", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan10", "acl": 110, "direction": "out", "misconfig_type": "wildcard", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 110", "no deny udp 10.0.30.0 0.0.0.63 host 192.0.2.25 eq 8080", "deny udp 10.0.30.0 0.0.255.255 host 192.0.2.25 eq 8080", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 100, "interface": "Vlan30", "direction": "in", "src": "10.0.30.0 0.0.0.255", "dst": "10.0.1.10", "service": "tcp/161", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan30", "acl": 100, "direction": "in", "deny_hits": 5000, "existing_rules_hint": ["deny tcp 10.0.30.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 100", "permit tcp 10.0.30.0 0.0.0.255 host 10.0.1.10 eq 161", "exit", "interface Vlan30", "ip access-group 100 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "critical", "acl": 199, "interface": "GigabitEthernet0/0", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "acl": 199, "direction": "out", "misconfig_type": "direction", "symptom": "unexpected deny"}], "cli_fix": ["interface GigabitEthernet0/0", "no ip access-group 199 in", "no ip access-group 199 out", "ip access-group 199 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "medium", "acl": 110, "interface": "GigabitEthernet0/0", "direction": "out", "src": "10.0.10.0 0.0.0.63", "dst": "203.0.113.50", "service": "tcp/22", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "acl": 110, "direction": "out", "deny_hits": 200, "existing_rules_hint": ["deny tcp 10.0.10.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit tcp 10.0.10.0 0.0.0.63 host 203.0.113.50 eq 22", "exit", "interface GigabitEthernet0/0", "ip access-group 110 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "high", "acl": 110, "interface": "GigabitEthernet0/0", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/0", "acl": 110, "direction": "out", "misconfig_type": "direction", "symptom": "unexpected deny"}], "cli_fix": ["interface GigabitEthernet0/0", "no ip access-group 110 in", "no ip access-group 110 out", "ip access-group 110 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "medium", "acl": 150, "interface": "Vlan40", "direction": "in", "src": "10.0.20.0 0.0.0.63", "dst": "10.0.1.10", "service": "tcp/53", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan40", "acl": 150, "direction": "in", "deny_hits": 1200, "existing_rules_hint": ["deny tcp 10.0.20.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 150", "permit tcp 10.0.20.0 0.0.0.63 host 10.0.1.10 eq 53", "exit", "interface Vlan40", "ip access-group 150 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 120, "interface": "GigabitEthernet0/3", "direction": "in", "src": "10.0.30.0 0.0.0.15", "dst": "10.0.2.20", "service": "tcp/23", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "acl": 120, "direction": "in", "deny_hits": 200, "existing_rules_hint": ["deny tcp 10.0.30.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 120", "permit tcp 10.0.30.0 0.0.0.15 host 10.0.2.20 eq 23", "exit", "interface GigabitEthernet0/3", "ip access-group 120 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "medium", "acl": 120, "interface": "Vlan40", "direction": "out", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan40", "acl": 120, "direction": "out", "misconfig_type": "wildcard", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 120", "no deny udp 10.0.40.0 0.0.0.15 host 10.0.3.30 eq 80", "deny udp 10.0.40.0 0.0.0.63 host 10.0.3.30 eq 80", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "medium", "acl": 199, "interface": "Vlan99", "direction": "in", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan99", "acl": 199, "direction": "in", "misconfig_type": "direction", "symptom": "policy not applied"}], "cli_fix": ["interface Vlan99", "no ip access-group 199 in", "no ip access-group 199 out", "ip access-group 199 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "high", "acl": 120, "interface": "Vlan50", "direction": "out", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan50", "acl": 120, "direction": "out", "deny_rate": 200, "top_source": "10.0.20.0 0.0.0.63", "top_dest": "203.0.113.50", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 120", "deny udp 10.0.20.0 0.0.0.63 host 203.0.113.50", "exit", "interface Vlan50", "ip access-group 120 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 100, "interface": "Vlan99", "direction": "out", "src": "172.16.10.0 0.0.0.15", "dst": "10.0.2.20", "service": "udp/53", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan99", "acl": 100, "direction": "out", "deny_hits": 1200, "existing_rules_hint": ["deny udp 172.16.10.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 100", "permit udp 172.16.10.0 0.0.0.15 host 10.0.2.20 eq 53", "exit", "interface Vlan99", "ip access-group 100 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "high", "acl": 110, "interface": "Vlan50", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan50", "acl": 110, "direction": "out", "misconfig_type": "direction", "symptom": "unexpected deny"}], "cli_fix": ["interface Vlan50", "no ip access-group 110 in", "no ip access-group 110 out", "ip access-group 110 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "high", "acl": 110, "interface": "Vlan99", "direction": "in", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan99", "acl": 110, "direction": "in", "misconfig_type": "direction", "symptom": "unexpected permit"}], "cli_fix": ["interface Vlan99", "no ip access-group 110 in", "no ip access-group 110 out", "ip access-group 110 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "high", "acl": 110, "interface": "Vlan40", "direction": "in", "src": "10.0.30.0 0.0.0.63", "dst": "10.0.1.10", "service": "udp/123", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan40", "acl": 110, "direction": "in", "deny_hits": 5000, "existing_rules_hint": ["deny udp 10.0.30.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit udp 10.0.30.0 0.0.0.63 host 10.0.1.10 eq 123", "exit", "interface Vlan40", "ip access-group 110 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 150, "interface": "GigabitEthernet0/1", "direction": "out", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "acl": 150, "direction": "out", "deny_rate": 1200, "top_source": "10.0.40.0 0.0.0.63", "top_dest": "10.0.1.10", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 150", "permit tcp 10.0.40.0 0.0.0.63 host 10.0.1.10 eq 22", "exit", "interface GigabitEthernet0/1", "ip access-group 150 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 199, "interface": "GigabitEthernet0/3", "direction": "in", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/3", "acl": 199, "direction": "in", "deny_rate": 500, "top_source": "192.168.1.0 0.0.0.63", "top_dest": "203.0.113.50", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 199", "deny tcp 192.168.1.0 0.0.0.63 host 203.0.113.50", "exit", "interface GigabitEthernet0/3", "ip access-group 199 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "medium", "acl": 101, "interface": "Vlan40", "direction": "in", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan40", "acl": 101, "direction": "in", "misconfig_type": "direction", "symptom": "unexpected deny"}], "cli_fix": ["interface Vlan40", "no ip access-group 101 in", "no ip access-group 101 out", "ip access-group 101 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "high", "acl": 100, "interface": "GigabitEthernet0/1", "direction": "in", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "acl": 100, "direction": "in", "misconfig_type": "protocol", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 100", "no deny tcp 172.16.10.0 0.0.255.255 host 198.51.100.10 eq 53", "deny udp 172.16.10.0 0.0.255.255 host 198.51.100.10 eq 53", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "high", "acl": 100, "interface": "GigabitEthernet0/1", "direction": "out", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "acl": 100, "direction": "out", "misconfig_type": "wildcard", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 100", "no deny tcp 172.16.10.0 0.0.0.63 host 10.0.2.20 eq 123", "deny tcp 172.16.10.0 0.0.0.15 host 10.0.2.20 eq 123", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "high", "acl": 101, "interface": "GigabitEthernet0/3", "direction": "out", "src": "10.0.20.0 0.0.255.255", "dst": "192.0.2.25", "service": "tcp/22", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "acl": 101, "direction": "out", "deny_hits": 500, "existing_rules_hint": ["deny tcp 10.0.20.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 101", "permit tcp 10.0.20.0 0.0.255.255 host 192.0.2.25 eq 22", "exit", "interface GigabitEthernet0/3", "ip access-group 101 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "critical", "acl": 101, "interface": "Vlan99", "direction": "out", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan99", "acl": 101, "direction": "out", "misconfig_type": "protocol", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 101", "no deny tcp 192.168.1.0 0.0.0.255 host 192.0.2.25 eq 3389", "deny udp 192.168.1.0 0.0.0.255 host 192.0.2.25 eq 3389", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 100, "interface": "Vlan50", "direction": "out", "src": "10.0.20.0 0.0.0.255", "dst": "203.0.113.50", "service": "tcp/514", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan50", "acl": 100, "direction": "out", "deny_hits": 500, "existing_rules_hint": ["deny tcp 10.0.20.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 100", "permit tcp 10.0.20.0 0.0.0.255 host 203.0.113.50 eq 514", "exit", "interface Vlan50", "ip access-group 100 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 110, "interface": "Vlan10", "direction": "out", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan10", "acl": 110, "direction": "out", "deny_rate": 1200, "top_source": "10.0.30.0 0.0.255.255", "top_dest": "192.0.2.25", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 110", "deny udp 10.0.30.0 0.0.255.255 host 192.0.2.25", "exit", "interface Vlan10", "ip access-group 110 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "medium", "acl": 101, "interface": "GigabitEthernet0/0", "direction": "out", "src": "172.16.10.0 0.0.0.63", "dst": "198.51.100.10", "service": "udp/80", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "acl": 101, "direction": "out", "deny_hits": 5000, "existing_rules_hint": ["deny udp 172.16.10.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 101", "permit udp 172.16.10.0 0.0.0.63 host 198.51.100.10 eq 80", "exit", "interface GigabitEthernet0/0", "ip access-group 101 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 150, "interface": "GigabitEthernet0/2", "direction": "in", "src": "10.0.20.0 0.0.0.15", "dst": "192.0.2.25", "service": "udp/80", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "acl": 150, "direction": "in", "deny_hits": 1200, "existing_rules_hint": ["deny udp 10.0.20.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 150", "permit udp 10.0.20.0 0.0.0.15 host 192.0.2.25 eq 80", "exit", "interface GigabitEthernet0/2", "ip access-group 150 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 150, "interface": "Vlan40", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan40", "acl": 150, "direction": "in", "deny_rate": 500, "top_source": "10.0.20.0 0.0.0.255", "top_dest": "10.0.2.20", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 150", "permit tcp 10.0.20.0 0.0.0.255 host 10.0.2.20 eq 80", "exit", "interface Vlan40", "ip access-group 150 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "high", "acl": 199, "interface": "Vlan99", "direction": "out", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan99", "acl": 199, "direction": "out", "deny_rate": 200, "top_source": "10.0.30.0 0.0.0.63", "top_dest": "10.0.2.20", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 199", "deny icmp 10.0.30.0 0.0.0.63 host 10.0.2.20", "exit", "interface Vlan99", "ip access-group 199 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "high", "acl": 100, "interface": "Vlan10", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan10", "acl": 100, "direction": "out", "deny_rate": 200, "top_source": "10.0.30.0 0.0.0.15", "top_dest": "10.0.2.20", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 100", "deny udp 10.0.30.0 0.0.0.15 host 10.0.2.20", "exit", "interface Vlan10", "ip access-group 100 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "high", "acl": 120, "interface": "Vlan30", "direction": "in", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan30", "acl": 120, "direction": "in", "misconfig_type": "protocol", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 120", "no deny tcp 172.16.10.0 0.0.0.15 host 192.0.2.25 eq 3389", "deny udp 172.16.10.0 0.0.0.15 host 192.0.2.25 eq 3389", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "high", "acl": 150, "interface": "Vlan99", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan99", "acl": 150, "direction": "in", "deny_rate": 500, "top_source": "10.0.20.0 0.0.0.255", "top_dest": "10.0.3.30", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 150", "permit tcp 10.0.20.0 0.0.0.255 host 10.0.3.30 eq 123", "exit", "interface Vlan99", "ip access-group 150 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "medium", "acl": 100, "interface": "Vlan10", "direction": "out", "src": "10.0.10.0 0.0.0.15", "dst": "203.0.113.50", "service": "udp/23", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan10", "acl": 100, "direction": "out", "deny_hits": 200, "existing_rules_hint": ["deny udp 10.0.10.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 100", "permit udp 10.0.10.0 0.0.0.15 host 203.0.113.50 eq 23", "exit", "interface Vlan10", "ip access-group 100 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "high", "acl": 100, "interface": "Vlan10", "direction": "in", "src": "10.0.40.0 0.0.0.15", "dst": "198.51.100.10", "service": "udp/514", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan10", "acl": 100, "direction": "in", "deny_hits": 500, "existing_rules_hint": ["deny udp 10.0.40.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 100", "permit udp 10.0.40.0 0.0.0.15 host 198.51.100.10 eq 514", "exit", "interface Vlan10", "ip access-group 100 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "high", "acl": 110, "interface": "GigabitEthernet0/3", "direction": "in", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/3", "acl": 110, "direction": "in", "misconfig_type": "direction", "symptom": "unexpected deny"}], "cli_fix": ["interface GigabitEthernet0/3", "no ip access-group 110 in", "no ip access-group 110 out", "ip access-group 110 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "medium", "acl": 120, "interface": "Vlan30", "direction": "in", "src": "10.0.10.0 0.0.0.15", "dst": "192.0.2.25", "service": "udp/80", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan30", "acl": 120, "direction": "in", "deny_hits": 200, "existing_rules_hint": ["deny udp 10.0.10.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 120", "permit udp 10.0.10.0 0.0.0.15 host 192.0.2.25 eq 80", "exit", "interface Vlan30", "ip access-group 120 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "high", "acl": 120, "interface": "Vlan20", "direction": "out", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan20", "acl": 120, "direction": "out", "deny_rate": 200, "top_source": "10.0.20.0 0.0.255.255", "top_dest": "203.0.113.50", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 120", "permit tcp 10.0.20.0 0.0.255.255 host 203.0.113.50 eq 80", "exit", "interface Vlan20", "ip access-group 120 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "high", "acl": 150, "interface": "Vlan99", "direction": "in", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan99", "acl": 150, "direction": "in", "misconfig_type": "wildcard", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 150", "no deny tcp 10.0.40.0 0.0.0.63 host 198.51.100.10 eq 23", "deny tcp 10.0.40.0 0.0.0.255 host 198.51.100.10 eq 23", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 100, "interface": "GigabitEthernet0/1", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "acl": 100, "direction": "in", "deny_rate": 200, "top_source": "172.16.10.0 0.0.0.15", "top_dest": "192.0.2.25", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 100", "permit tcp 172.16.10.0 0.0.0.15 host 192.0.2.25 eq 8080", "exit", "interface GigabitEthernet0/1", "ip access-group 100 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 110, "interface": "GigabitEthernet0/0", "direction": "in", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "acl": 110, "direction": "in", "deny_rate": 5000, "top_source": "10.0.20.0 0.0.0.15", "top_dest": "203.0.113.50", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 110", "permit tcp 10.0.20.0 0.0.0.15 host 203.0.113.50 eq 23", "exit", "interface GigabitEthernet0/0", "ip access-group 110 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "medium", "acl": 120, "interface": "GigabitEthernet0/2", "direction": "in", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "acl": 120, "direction": "in", "misconfig_type": "direction", "symptom": "policy not applied"}], "cli_fix": ["interface GigabitEthernet0/2", "no ip access-group 120 in", "no ip access-group 120 out", "ip access-group 120 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 110, "interface": "Vlan20", "direction": "in", "src": "10.0.10.0 0.0.0.63", "dst": "10.0.3.30", "service": "tcp/22", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan20", "acl": 110, "direction": "in", "deny_hits": 500, "existing_rules_hint": ["deny tcp 10.0.10.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit tcp 10.0.10.0 0.0.0.63 host 10.0.3.30 eq 22", "exit", "interface Vlan20", "ip access-group 110 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "medium", "acl": 199, "interface": "Vlan10", "direction": "out", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan10", "acl": 199, "direction": "out", "misconfig_type": "wildcard", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 199", "no deny tcp 10.0.40.0 0.0.0.63 host 203.0.113.50 eq 161", "deny tcp 10.0.40.0 0.0.0.255 host 203.0.113.50 eq 161", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 100, "interface": "GigabitEthernet0/3", "direction": "in", "src": "10.0.30.0 0.0.0.255", "dst": "203.0.113.50", "service": "tcp/23", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "acl": 100, "direction": "in", "deny_hits": 5000, "existing_rules_hint": ["deny tcp 10.0.30.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 100", "permit tcp 10.0.30.0 0.0.0.255 host 203.0.113.50 eq 23", "exit", "interface GigabitEthernet0/3", "ip access-group 100 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "critical", "acl": 199, "interface": "Vlan99", "direction": "in", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan99", "acl": 199, "direction": "in", "misconfig_type": "direction", "symptom": "unexpected deny"}], "cli_fix": ["interface Vlan99", "no ip access-group 199 in", "no ip access-group 199 out", "ip access-group 199 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 110, "interface": "Vlan30", "direction": "out", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan30", "acl": 110, "direction": "out", "deny_rate": 1200, "top_source": "10.0.10.0 0.0.0.15", "top_dest": "10.0.1.10", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 110", "permit tcp 10.0.10.0 0.0.0.15 host 10.0.1.10 eq 443", "exit", "interface Vlan30", "ip access-group 110 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "high", "acl": 100, "interface": "GigabitEthernet0/3", "direction": "in", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "acl": 100, "direction": "in", "misconfig_type": "protocol", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 100", "no deny udp 172.16.10.0 0.0.0.63 host 192.0.2.25 eq 123", "deny tcp 172.16.10.0 0.0.0.63 host 192.0.2.25 eq 123", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 120, "interface": "Vlan20", "direction": "out", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan20", "acl": 120, "direction": "out", "deny_rate": 5000, "top_source": "10.0.10.0 0.0.0.15", "top_dest": "10.0.3.30", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 120", "deny icmp 10.0.10.0 0.0.0.15 host 10.0.3.30", "exit", "interface Vlan20", "ip access-group 120 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "medium", "acl": 199, "interface": "Vlan50", "direction": "out", "src": "10.0.30.0 0.0.0.63", "dst": "10.0.2.20", "service": "udp/80", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan50", "acl": 199, "direction": "out", "deny_hits": 5000, "existing_rules_hint": ["deny udp 10.0.30.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit udp 10.0.30.0 0.0.0.63 host 10.0.2.20 eq 80", "exit", "interface Vlan50", "ip access-group 199 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "medium", "acl": 120, "interface": "Vlan99", "direction": "in", "src": "172.16.10.0 0.0.0.15", "dst": "10.0.2.20", "service": "tcp/22", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan99", "acl": 120, "direction": "in", "deny_hits": 5000, "existing_rules_hint": ["deny tcp 172.16.10.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 120", "permit tcp 172.16.10.0 0.0.0.15 host 10.0.2.20 eq 22", "exit", "interface Vlan99", "ip access-group 120 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "medium", "acl": 199, "interface": "GigabitEthernet0/2", "direction": "out", "src": "172.16.10.0 0.0.255.255", "dst": "10.0.1.10", "service": "udp/123", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/2", "acl": 199, "direction": "out", "deny_hits": 500, "existing_rules_hint": ["deny udp 172.16.10.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit udp 172.16.10.0 0.0.255.255 host 10.0.1.10 eq 123", "exit", "interface GigabitEthernet0/2", "ip access-group 199 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 110, "interface": "Vlan20", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan20", "acl": 110, "direction": "out", "deny_rate": 500, "top_source": "10.0.10.0 0.0.255.255", "top_dest": "10.0.3.30", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 110", "deny icmp 10.0.10.0 0.0.255.255 host 10.0.3.30", "exit", "interface Vlan20", "ip access-group 110 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 100, "interface": "Vlan40", "direction": "in", "src": "10.0.20.0 0.0.0.15", "dst": "10.0.3.30", "service": "tcp/8080", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan40", "acl": 100, "direction": "in", "deny_hits": 1200, "existing_rules_hint": ["deny tcp 10.0.20.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 100", "permit tcp 10.0.20.0 0.0.0.15 host 10.0.3.30 eq 8080", "exit", "interface Vlan40", "ip access-group 100 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "critical", "acl": 199, "interface": "Vlan50", "direction": "out", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan50", "acl": 199, "direction": "out", "misconfig_type": "wildcard", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 199", "no deny udp 192.168.1.0 0.0.0.255 host 10.0.2.20 eq 123", "deny udp 192.168.1.0 0.0.0.15 host 10.0.2.20 eq 123", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "critical", "acl": 120, "interface": "GigabitEthernet0/1", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "acl": 120, "direction": "out", "misconfig_type": "direction", "symptom": "policy not applied"}], "cli_fix": ["interface GigabitEthernet0/1", "no ip access-group 120 in", "no ip access-group 120 out", "ip access-group 120 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 101, "interface": "Vlan40", "direction": "in", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan40", "acl": 101, "direction": "in", "deny_rate": 500, "top_source": "10.0.40.0 0.0.0.255", "top_dest": "198.51.100.10", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 101", "permit tcp 10.0.40.0 0.0.0.255 host 198.51.100.10 eq 8080", "exit", "interface Vlan40", "ip access-group 101 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "medium", "acl": 120, "interface": "GigabitEthernet0/1", "direction": "in", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "acl": 120, "direction": "in", "misconfig_type": "direction", "symptom": "policy not applied"}], "cli_fix": ["interface GigabitEthernet0/1", "no ip access-group 120 in", "no ip access-group 120 out", "ip access-group 120 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "high", "acl": 100, "interface": "Vlan50", "direction": "out", "src": "10.0.10.0 0.0.0.63", "dst": "10.0.1.10", "service": "tcp/161", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan50", "acl": 100, "direction": "out", "deny_hits": 200, "existing_rules_hint": ["deny tcp 10.0.10.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 100", "permit tcp 10.0.10.0 0.0.0.63 host 10.0.1.10 eq 161", "exit", "interface Vlan50", "ip access-group 100 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "high", "acl": 199, "interface": "Vlan20", "direction": "out", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan20", "acl": 199, "direction": "out", "deny_rate": 500, "top_source": "10.0.30.0 0.0.255.255", "top_dest": "10.0.1.10", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 199", "permit tcp 10.0.30.0 0.0.255.255 host 10.0.1.10 eq 23", "exit", "interface Vlan20", "ip access-group 199 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "medium", "acl": 100, "interface": "Vlan20", "direction": "in", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan20", "acl": 100, "direction": "in", "misconfig_type": "protocol", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 100", "no deny tcp 172.16.10.0 0.0.255.255 host 203.0.113.50 eq 443", "deny udp 172.16.10.0 0.0.255.255 host 203.0.113.50 eq 443", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "medium", "acl": 120, "interface": "Vlan40", "direction": "out", "src": "192.168.1.0 0.0.0.15", "dst": "10.0.3.30", "service": "tcp/23", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan40", "acl": 120, "direction": "out", "deny_hits": 500, "existing_rules_hint": ["deny tcp 192.168.1.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 120", "permit tcp 192.168.1.0 0.0.0.15 host 10.0.3.30 eq 23", "exit", "interface Vlan40", "ip access-group 120 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 120, "interface": "GigabitEthernet0/1", "direction": "out", "src": "10.0.10.0 0.0.255.255", "dst": "10.0.1.10", "service": "tcp/443", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "acl": 120, "direction": "out", "deny_hits": 200, "existing_rules_hint": ["deny tcp 10.0.10.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 120", "permit tcp 10.0.10.0 0.0.255.255 host 10.0.1.10 eq 443", "exit", "interface GigabitEthernet0/1", "ip access-group 120 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "high", "acl": 150, "interface": "GigabitEthernet0/0", "direction": "in", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/0", "acl": 150, "direction": "in", "deny_rate": 500, "top_source": "192.168.1.0 0.0.0.63", "top_dest": "192.0.2.25", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 150", "deny udp 192.168.1.0 0.0.0.63 host 192.0.2.25", "exit", "interface GigabitEthernet0/0", "ip access-group 150 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 120, "interface": "GigabitEthernet0/3", "direction": "out", "src": "10.0.20.0 0.0.0.63", "dst": "10.0.1.10", "service": "tcp/23", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/3", "acl": 120, "direction": "out", "deny_hits": 1200, "existing_rules_hint": ["deny tcp 10.0.20.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 120", "permit tcp 10.0.20.0 0.0.0.63 host 10.0.1.10 eq 23", "exit", "interface GigabitEthernet0/3", "ip access-group 120 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 100, "interface": "Vlan10", "direction": "in", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan10", "acl": 100, "direction": "in", "deny_rate": 5000, "top_source": "10.0.30.0 0.0.255.255", "top_dest": "203.0.113.50", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 100", "permit tcp 10.0.30.0 0.0.255.255 host 203.0.113.50 eq 514", "exit", "interface Vlan10", "ip access-group 100 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "critical", "acl": 120, "interface": "GigabitEthernet0/3", "direction": "in", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/3", "acl": 120, "direction": "in", "misconfig_type": "protocol", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 120", "no deny udp 172.16.10.0 0.0.255.255 host 198.51.100.10 eq 23", "deny tcp 172.16.10.0 0.0.255.255 host 198.51.100.10 eq 23", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "medium", "acl": 110, "interface": "GigabitEthernet0/0", "direction": "out", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "acl": 110, "direction": "out", "misconfig_type": "protocol", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 110", "no deny udp 10.0.30.0 0.0.0.15 host 192.0.2.25 eq 3389", "deny tcp 10.0.30.0 0.0.0.15 host 192.0.2.25 eq 3389", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 101, "interface": "GigabitEthernet0/0", "direction": "in", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "acl": 101, "direction": "in", "deny_rate": 5000, "top_source": "10.0.30.0 0.0.255.255", "top_dest": "203.0.113.50", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 101", "permit tcp 10.0.30.0 0.0.255.255 host 203.0.113.50 eq 22", "exit", "interface GigabitEthernet0/0", "ip access-group 101 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "critical", "acl": 150, "interface": "Vlan20", "direction": "in", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan20", "acl": 150, "direction": "in", "misconfig_type": "wildcard", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 150", "no deny udp 172.16.10.0 0.0.0.255 host 198.51.100.10 eq 53", "deny udp 172.16.10.0 0.0.255.255 host 198.51.100.10 eq 53", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "medium", "acl": 199, "interface": "Vlan50", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan50", "acl": 199, "direction": "out", "misconfig_type": "direction", "symptom": "unexpected deny"}], "cli_fix": ["interface Vlan50", "no ip access-group 199 in", "no ip access-group 199 out", "ip access-group 199 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "high", "acl": 110, "interface": "Vlan10", "direction": "in", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan10", "acl": 110, "direction": "in", "deny_rate": 1200, "top_source": "10.0.40.0 0.0.255.255", "top_dest": "198.51.100.10", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 110", "permit tcp 10.0.40.0 0.0.255.255 host 198.51.100.10 eq 123", "exit", "interface Vlan10", "ip access-group 110 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "medium", "acl": 120, "interface": "GigabitEthernet0/2", "direction": "out", "src": "172.16.10.0 0.0.0.15", "dst": "192.0.2.25", "service": "udp/23", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "acl": 120, "direction": "out", "deny_hits": 200, "existing_rules_hint": ["deny udp 172.16.10.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 120", "permit udp 172.16.10.0 0.0.0.15 host 192.0.2.25 eq 23", "exit", "interface GigabitEthernet0/2", "ip access-group 120 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "high", "acl": 110, "interface": "GigabitEthernet0/1", "direction": "out", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "acl": 110, "direction": "out", "misconfig_type": "protocol", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 110", "no deny udp 172.16.10.0 0.0.255.255 host 10.0.3.30 eq 443", "deny tcp 172.16.10.0 0.0.255.255 host 10.0.3.30 eq 443", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "high", "acl": 100, "interface": "Vlan40", "direction": "in", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan40", "acl": 100, "direction": "in", "misconfig_type": "direction", "symptom": "unexpected permit"}], "cli_fix": ["interface Vlan40", "no ip access-group 100 in", "no ip access-group 100 out", "ip access-group 100 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "high", "acl": 199, "interface": "GigabitEthernet0/0", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "acl": 199, "direction": "out", "deny_rate": 500, "top_source": "10.0.10.0 0.0.255.255", "top_dest": "10.0.2.20", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 199", "deny icmp 10.0.10.0 0.0.255.255 host 10.0.2.20", "exit", "interface GigabitEthernet0/0", "ip access-group 199 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "high", "acl": 110, "interface": "Vlan30", "direction": "in", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan30", "acl": 110, "direction": "in", "deny_rate": 1200, "top_source": "172.16.10.0 0.0.0.255", "top_dest": "10.0.2.20", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 110", "deny tcp 172.16.10.0 0.0.0.255 host 10.0.2.20", "exit", "interface Vlan30", "ip access-group 110 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 120, "interface": "Vlan40", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan40", "acl": 120, "direction": "out", "deny_rate": 500, "top_source": "10.0.40.0 0.0.255.255", "top_dest": "203.0.113.50", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 120", "deny tcp 10.0.40.0 0.0.255.255 host 203.0.113.50", "exit", "interface Vlan40", "ip access-group 120 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "medium", "acl": 101, "interface": "GigabitEthernet0/3", "direction": "out", "src": "10.0.30.0 0.0.255.255", "dst": "192.0.2.25", "service": "tcp/161", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/3", "acl": 101, "direction": "out", "deny_hits": 5000, "existing_rules_hint": ["deny tcp 10.0.30.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 101", "permit tcp 10.0.30.0 0.0.255.255 host 192.0.2.25 eq 161", "exit", "interface GigabitEthernet0/3", "ip access-group 101 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "high", "acl": 100, "interface": "Vlan30", "direction": "in", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan30", "acl": 100, "direction": "in", "misconfig_type": "wildcard", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 100", "no deny tcp 10.0.10.0 0.0.0.255 host 10.0.1.10 eq 23", "deny tcp 10.0.10.0 0.0.0.15 host 10.0.1.10 eq 23", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "high", "acl": 110, "interface": "GigabitEthernet0/2", "direction": "in", "src": "10.0.20.0 0.0.0.63", "dst": "203.0.113.50", "service": "udp/514", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/2", "acl": 110, "direction": "in", "deny_hits": 200, "existing_rules_hint": ["deny udp 10.0.20.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit udp 10.0.20.0 0.0.0.63 host 203.0.113.50 eq 514", "exit", "interface GigabitEthernet0/2", "ip access-group 110 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "medium", "acl": 110, "interface": "GigabitEthernet0/2", "direction": "in", "src": "10.0.30.0 0.0.0.63", "dst": "10.0.3.30", "service": "tcp/161", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "acl": 110, "direction": "in", "deny_hits": 200, "existing_rules_hint": ["deny tcp 10.0.30.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit tcp 10.0.30.0 0.0.0.63 host 10.0.3.30 eq 161", "exit", "interface GigabitEthernet0/2", "ip access-group 110 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "high", "acl": 199, "interface": "GigabitEthernet0/3", "direction": "in", "src": "192.168.1.0 0.0.255.255", "dst": "203.0.113.50", "service": "udp/22", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "acl": 199, "direction": "in", "deny_hits": 200, "existing_rules_hint": ["deny udp 192.168.1.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit udp 192.168.1.0 0.0.255.255 host 203.0.113.50 eq 22", "exit", "interface GigabitEthernet0/3", "ip access-group 199 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "critical", "acl": 120, "interface": "Vlan50", "direction": "out", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan50", "acl": 120, "direction": "out", "misconfig_type": "wildcard", "symptom": "unexpected permit"}], "cli_fix": ["ip access-list extended 120", "no deny tcp 10.0.40.0 0.0.0.255 host 203.0.113.50 eq 161", "deny tcp 10.0.40.0 0.0.0.15 host 203.0.113.50 eq 161", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "medium", "acl": 110, "interface": "Vlan30", "direction": "out", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan30", "acl": 110, "direction": "out", "misconfig_type": "wildcard", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 110", "no deny udp 10.0.20.0 0.0.0.15 host 198.51.100.10 eq 3389", "deny udp 10.0.20.0 0.0.255.255 host 198.51.100.10 eq 3389", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 150, "interface": "Vlan99", "direction": "in", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan99", "acl": 150, "direction": "in", "deny_rate": 5000, "top_source": "10.0.10.0 0.0.255.255", "top_dest": "203.0.113.50", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 150", "deny icmp 10.0.10.0 0.0.255.255 host 203.0.113.50", "exit", "interface Vlan99", "ip access-group 150 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 120, "interface": "Vlan20", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan20", "acl": 120, "direction": "in", "deny_rate": 200, "top_source": "10.0.40.0 0.0.0.255", "top_dest": "10.0.1.10", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 120", "permit tcp 10.0.40.0 0.0.0.255 host 10.0.1.10 eq 80", "exit", "interface Vlan20", "ip access-group 120 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "medium", "acl": 199, "interface": "GigabitEthernet0/3", "direction": "in", "src": "10.0.40.0 0.0.0.15", "dst": "10.0.1.10", "service": "udp/161", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/3", "acl": 199, "direction": "in", "deny_hits": 1200, "existing_rules_hint": ["deny udp 10.0.40.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit udp 10.0.40.0 0.0.0.15 host 10.0.1.10 eq 161", "exit", "interface GigabitEthernet0/3", "ip access-group 199 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "high", "acl": 110, "interface": "Vlan40", "direction": "in", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan40", "acl": 110, "direction": "in", "misconfig_type": "direction", "symptom": "policy not applied"}], "cli_fix": ["interface Vlan40", "no ip access-group 110 in", "no ip access-group 110 out", "ip access-group 110 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "high", "acl": 101, "interface": "Vlan30", "direction": "in", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan30", "acl": 101, "direction": "in", "deny_rate": 1200, "top_source": "10.0.30.0 0.0.0.255", "top_dest": "10.0.1.10", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 101", "deny tcp 10.0.30.0 0.0.0.255 host 10.0.1.10", "exit", "interface Vlan30", "ip access-group 101 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "medium", "acl": 120, "interface": "Vlan10", "direction": "in", "src": "192.168.1.0 0.0.0.15", "dst": "10.0.3.30", "service": "udp/514", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan10", "acl": 120, "direction": "in", "deny_hits": 200, "existing_rules_hint": ["deny udp 192.168.1.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 120", "permit udp 192.168.1.0 0.0.0.15 host 10.0.3.30 eq 514", "exit", "interface Vlan10", "ip access-group 120 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "critical", "acl": 199, "interface": "Vlan40", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan40", "acl": 199, "direction": "out", "misconfig_type": "direction", "symptom": "unexpected deny"}], "cli_fix": ["interface Vlan40", "no ip access-group 199 in", "no ip access-group 199 out", "ip access-group 199 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "high", "acl": 199, "interface": "Vlan50", "direction": "in", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan50", "acl": 199, "direction": "in", "misconfig_type": "protocol", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 199", "no deny tcp 192.168.1.0 0.0.0.63 host 10.0.2.20 eq 3389", "deny udp 192.168.1.0 0.0.0.63 host 10.0.2.20 eq 3389", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 101, "interface": "Vlan50", "direction": "in", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan50", "acl": 101, "direction": "in", "deny_rate": 5000, "top_source": "10.0.20.0 0.0.255.255", "top_dest": "10.0.2.20", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 101", "deny tcp 10.0.20.0 0.0.255.255 host 10.0.2.20", "exit", "interface Vlan50", "ip access-group 101 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "medium", "acl": 150, "interface": "GigabitEthernet0/1", "direction": "out", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "acl": 150, "direction": "out", "deny_rate": 5000, "top_source": "10.0.20.0 0.0.0.255", "top_dest": "203.0.113.50", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 150", "deny tcp 10.0.20.0 0.0.0.255 host 203.0.113.50", "exit", "interface GigabitEthernet0/1", "ip access-group 150 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "medium", "acl": 120, "interface": "GigabitEthernet0/0", "direction": "in", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "acl": 120, "direction": "in", "deny_rate": 200, "top_source": "10.0.10.0 0.0.0.63", "top_dest": "203.0.113.50", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 120", "deny udp 10.0.10.0 0.0.0.63 host 203.0.113.50", "exit", "interface GigabitEthernet0/0", "ip access-group 120 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "medium", "acl": 100, "interface": "Vlan40", "direction": "out", "src": "192.168.1.0 0.0.0.63", "dst": "10.0.2.20", "service": "tcp/80", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan40", "acl": 100, "direction": "out", "deny_hits": 5000, "existing_rules_hint": ["deny tcp 192.168.1.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 100", "permit tcp 192.168.1.0 0.0.0.63 host 10.0.2.20 eq 80", "exit", "interface Vlan40", "ip access-group 100 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "high", "acl": 100, "interface": "Vlan20", "direction": "out", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan20", "acl": 100, "direction": "out", "deny_rate": 200, "top_source": "10.0.10.0 0.0.255.255", "top_dest": "192.0.2.25", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 100", "deny icmp 10.0.10.0 0.0.255.255 host 192.0.2.25", "exit", "interface Vlan20", "ip access-group 100 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 150, "interface": "GigabitEthernet0/1", "direction": "out", "src": "10.0.30.0 0.0.0.63", "dst": "10.0.2.20", "service": "udp/443", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "acl": 150, "direction": "out", "deny_hits": 200, "existing_rules_hint": ["deny udp 10.0.30.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 150", "permit udp 10.0.30.0 0.0.0.63 host 10.0.2.20 eq 443", "exit", "interface GigabitEthernet0/1", "ip access-group 150 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "medium", "acl": 100, "interface": "Vlan20", "direction": "out", "src": "192.168.1.0 0.0.0.15", "dst": "10.0.2.20", "service": "tcp/443", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan20", "acl": 100, "direction": "out", "deny_hits": 500, "existing_rules_hint": ["deny tcp 192.168.1.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 100", "permit tcp 192.168.1.0 0.0.0.15 host 10.0.2.20 eq 443", "exit", "interface Vlan20", "ip access-group 100 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "critical", "acl": 150, "interface": "Vlan40", "direction": "in", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan40", "acl": 150, "direction": "in", "misconfig_type": "wildcard", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 150", "no deny tcp 172.16.10.0 0.0.255.255 host 10.0.2.20 eq 23", "deny tcp 172.16.10.0 0.0.0.255 host 10.0.2.20 eq 23", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 110, "interface": "Vlan30", "direction": "in", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan30", "acl": 110, "direction": "in", "deny_rate": 200, "top_source": "192.168.1.0 0.0.0.15", "top_dest": "10.0.1.10", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 110", "deny icmp 192.168.1.0 0.0.0.15 host 10.0.1.10", "exit", "interface Vlan30", "ip access-group 110 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 110, "interface": "Vlan99", "direction": "in", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan99", "acl": 110, "direction": "in", "deny_rate": 5000, "top_source": "10.0.10.0 0.0.0.63", "top_dest": "192.0.2.25", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 110", "deny icmp 10.0.10.0 0.0.0.63 host 192.0.2.25", "exit", "interface Vlan99", "ip access-group 110 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "high", "acl": 101, "interface": "Vlan10", "direction": "in", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan10", "acl": 101, "direction": "in", "deny_rate": 500, "top_source": "192.168.1.0 0.0.255.255", "top_dest": "192.0.2.25", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 101", "permit tcp 192.168.1.0 0.0.255.255 host 192.0.2.25 eq 80", "exit", "interface Vlan10", "ip access-group 101 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "high", "acl": 100, "interface": "GigabitEthernet0/0", "direction": "in", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "acl": 100, "direction": "in", "deny_rate": 5000, "top_source": "172.16.10.0 0.0.0.255", "top_dest": "192.0.2.25", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 100", "deny udp 172.16.10.0 0.0.0.255 host 192.0.2.25", "exit", "interface GigabitEthernet0/0", "ip access-group 100 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "high", "acl": 150, "interface": "Vlan99", "direction": "out", "src": "192.168.1.0 0.0.0.255", "dst": "10.0.2.20", "service": "tcp/23", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan99", "acl": 150, "direction": "out", "deny_hits": 500, "existing_rules_hint": ["deny tcp 192.168.1.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 150", "permit tcp 192.168.1.0 0.0.0.255 host 10.0.2.20 eq 23", "exit", "interface Vlan99", "ip access-group 150 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "high", "acl": 199, "interface": "Vlan99", "direction": "out", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan99", "acl": 199, "direction": "out", "misconfig_type": "protocol", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 199", "no deny tcp 10.0.20.0 0.0.0.255 host 10.0.3.30 eq 80", "deny udp 10.0.20.0 0.0.0.255 host 10.0.3.30 eq 80", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "critical", "acl": 101, "interface": "GigabitEthernet0/1", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "acl": 101, "direction": "out", "misconfig_type": "direction", "symptom": "unexpected permit"}], "cli_fix": ["interface GigabitEthernet0/1", "no ip access-group 101 in", "no ip access-group 101 out", "ip access-group 101 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "medium", "acl": 199, "interface": "Vlan10", "direction": "out", "src": "172.16.10.0 0.0.0.255", "dst": "203.0.113.50", "service": "tcp/514", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan10", "acl": 199, "direction": "out", "deny_hits": 200, "existing_rules_hint": ["deny tcp 172.16.10.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit tcp 172.16.10.0 0.0.0.255 host 203.0.113.50 eq 514", "exit", "interface Vlan10", "ip access-group 199 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 110, "interface": "Vlan10", "direction": "in", "src": "10.0.10.0 0.0.0.15", "dst": "10.0.3.30", "service": "udp/161", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan10", "acl": 110, "direction": "in", "deny_hits": 5000, "existing_rules_hint": ["deny udp 10.0.10.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit udp 10.0.10.0 0.0.0.15 host 10.0.3.30 eq 161", "exit", "interface Vlan10", "ip access-group 110 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "high", "acl": 100, "interface": "Vlan10", "direction": "in", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan10", "acl": 100, "direction": "in", "misconfig_type": "protocol", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 100", "no deny tcp 10.0.40.0 0.0.0.15 host 10.0.2.20 eq 161", "deny udp 10.0.40.0 0.0.0.15 host 10.0.2.20 eq 161", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "medium", "acl": 110, "interface": "Vlan99", "direction": "in", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan99", "acl": 110, "direction": "in", "deny_rate": 1200, "top_source": "10.0.40.0 0.0.0.255", "top_dest": "192.0.2.25", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 110", "deny icmp 10.0.40.0 0.0.0.255 host 192.0.2.25", "exit", "interface Vlan99", "ip access-group 110 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "medium", "acl": 110, "interface": "GigabitEthernet0/0", "direction": "in", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "acl": 110, "direction": "in", "deny_rate": 500, "top_source": "192.168.1.0 0.0.0.255", "top_dest": "10.0.2.20", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 110", "permit tcp 192.168.1.0 0.0.0.255 host 10.0.2.20 eq 22", "exit", "interface GigabitEthernet0/0", "ip access-group 110 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "medium", "acl": 199, "interface": "Vlan99", "direction": "in", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan99", "acl": 199, "direction": "in", "misconfig_type": "protocol", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 199", "no deny tcp 10.0.20.0 0.0.0.15 host 10.0.3.30 eq 53", "deny udp 10.0.20.0 0.0.0.15 host 10.0.3.30 eq 53", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "medium", "acl": 101, "interface": "Vlan10", "direction": "out", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan10", "acl": 101, "direction": "out", "misconfig_type": "wildcard", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 101", "no deny udp 10.0.40.0 0.0.0.255 host 10.0.1.10 eq 123", "deny udp 10.0.40.0 0.0.0.15 host 10.0.1.10 eq 123", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 101, "interface": "GigabitEthernet0/1", "direction": "in", "src": "10.0.30.0 0.0.0.63", "dst": "198.51.100.10", "service": "tcp/8080", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "acl": 101, "direction": "in", "deny_hits": 5000, "existing_rules_hint": ["deny tcp 10.0.30.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 101", "permit tcp 10.0.30.0 0.0.0.63 host 198.51.100.10 eq 8080", "exit", "interface GigabitEthernet0/1", "ip access-group 101 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "medium", "acl": 150, "interface": "GigabitEthernet0/3", "direction": "out", "src": "10.0.40.0 0.0.0.63", "dst": "192.0.2.25", "service": "tcp/80", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/3", "acl": 150, "direction": "out", "deny_hits": 1200, "existing_rules_hint": ["deny tcp 10.0.40.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 150", "permit tcp 10.0.40.0 0.0.0.63 host 192.0.2.25 eq 80", "exit", "interface GigabitEthernet0/3", "ip access-group 150 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 110, "interface": "Vlan20", "direction": "out", "src": "10.0.40.0 0.0.255.255", "dst": "203.0.113.50", "service": "udp/53", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan20", "acl": 110, "direction": "out", "deny_hits": 200, "existing_rules_hint": ["deny udp 10.0.40.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit udp 10.0.40.0 0.0.255.255 host 203.0.113.50 eq 53", "exit", "interface Vlan20", "ip access-group 110 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 199, "interface": "Vlan50", "direction": "out", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan50", "acl": 199, "direction": "out", "deny_rate": 5000, "top_source": "192.168.1.0 0.0.0.255", "top_dest": "10.0.3.30", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 199", "deny udp 192.168.1.0 0.0.0.255 host 10.0.3.30", "exit", "interface Vlan50", "ip access-group 199 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "medium", "acl": 100, "interface": "GigabitEthernet0/3", "direction": "out", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/3", "acl": 100, "direction": "out", "deny_rate": 200, "top_source": "192.168.1.0 0.0.255.255", "top_dest": "198.51.100.10", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 100", "permit tcp 192.168.1.0 0.0.255.255 host 198.51.100.10 eq 8080", "exit", "interface GigabitEthernet0/3", "ip access-group 100 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "medium", "acl": 101, "interface": "Vlan50", "direction": "out", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan50", "acl": 101, "direction": "out", "deny_rate": 1200, "top_source": "10.0.10.0 0.0.0.255", "top_dest": "192.0.2.25", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 101", "deny tcp 10.0.10.0 0.0.0.255 host 192.0.2.25", "exit", "interface Vlan50", "ip access-group 101 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "high", "acl": 110, "interface": "Vlan50", "direction": "in", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan50", "acl": 110, "direction": "in", "misconfig_type": "protocol", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 110", "no deny tcp 10.0.40.0 0.0.0.255 host 198.51.100.10 eq 514", "deny udp 10.0.40.0 0.0.0.255 host 198.51.100.10 eq 514", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "high", "acl": 120, "interface": "GigabitEthernet0/1", "direction": "in", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "acl": 120, "direction": "in", "deny_rate": 5000, "top_source": "10.0.10.0 0.0.255.255", "top_dest": "10.0.3.30", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 120", "permit tcp 10.0.10.0 0.0.255.255 host 10.0.3.30 eq 443", "exit", "interface GigabitEthernet0/1", "ip access-group 120 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "medium", "acl": 199, "interface": "GigabitEthernet0/0", "direction": "out", "src": "192.168.1.0 0.0.0.63", "dst": "192.0.2.25", "service": "udp/22", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/0", "acl": 199, "direction": "out", "deny_hits": 500, "existing_rules_hint": ["deny udp 192.168.1.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit udp 192.168.1.0 0.0.0.63 host 192.0.2.25 eq 22", "exit", "interface GigabitEthernet0/0", "ip access-group 199 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "high", "acl": 110, "interface": "GigabitEthernet0/3", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/3", "acl": 110, "direction": "out", "deny_rate": 500, "top_source": "10.0.40.0 0.0.0.63", "top_dest": "198.51.100.10", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 110", "deny tcp 10.0.40.0 0.0.0.63 host 198.51.100.10", "exit", "interface GigabitEthernet0/3", "ip access-group 110 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "high", "acl": 100, "interface": "Vlan30", "direction": "in", "src": "10.0.10.0 0.0.0.15", "dst": "10.0.3.30", "service": "udp/514", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan30", "acl": 100, "direction": "in", "deny_hits": 5000, "existing_rules_hint": ["deny udp 10.0.10.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 100", "permit udp 10.0.10.0 0.0.0.15 host 10.0.3.30 eq 514", "exit", "interface Vlan30", "ip access-group 100 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "high", "acl": 199, "interface": "Vlan99", "direction": "out", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan99", "acl": 199, "direction": "out", "misconfig_type": "protocol", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 199", "no deny tcp 10.0.10.0 0.0.0.255 host 198.51.100.10 eq 23", "deny udp 10.0.10.0 0.0.0.255 host 198.51.100.10 eq 23", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "medium", "acl": 199, "interface": "Vlan50", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan50", "acl": 199, "direction": "out", "misconfig_type": "direction", "symptom": "unexpected permit"}], "cli_fix": ["interface Vlan50", "no ip access-group 199 in", "no ip access-group 199 out", "ip access-group 199 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "medium", "acl": 150, "interface": "Vlan99", "direction": "in", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan99", "acl": 150, "direction": "in", "misconfig_type": "wildcard", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 150", "no deny tcp 10.0.30.0 0.0.0.255 host 10.0.2.20 eq 161", "deny tcp 10.0.30.0 0.0.0.15 host 10.0.2.20 eq 161", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "critical", "acl": 150, "interface": "Vlan10", "direction": "in", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan10", "acl": 150, "direction": "in", "misconfig_type": "direction", "symptom": "unexpected permit"}], "cli_fix": ["interface Vlan10", "no ip access-group 150 in", "no ip access-group 150 out", "ip access-group 150 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 100, "interface": "Vlan99", "direction": "out", "src": "172.16.10.0 0.0.0.255", "dst": "203.0.113.50", "service": "tcp/80", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan99", "acl": 100, "direction": "out", "deny_hits": 5000, "existing_rules_hint": ["deny tcp 172.16.10.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 100", "permit tcp 172.16.10.0 0.0.0.255 host 203.0.113.50 eq 80", "exit", "interface Vlan99", "ip access-group 100 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "high", "acl": 150, "interface": "Vlan10", "direction": "in", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan10", "acl": 150, "direction": "in", "misconfig_type": "direction", "symptom": "policy not applied"}], "cli_fix": ["interface Vlan10", "no ip access-group 150 in", "no ip access-group 150 out", "ip access-group 150 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "medium", "acl": 101, "interface": "Vlan20", "direction": "in", "src": "10.0.30.0 0.0.0.255", "dst": "10.0.1.10", "service": "udp/22", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan20", "acl": 101, "direction": "in", "deny_hits": 1200, "existing_rules_hint": ["deny udp 10.0.30.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 101", "permit udp 10.0.30.0 0.0.0.255 host 10.0.1.10 eq 22", "exit", "interface Vlan20", "ip access-group 101 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 199, "interface": "Vlan50", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan50", "acl": 199, "direction": "in", "deny_rate": 1200, "top_source": "10.0.20.0 0.0.255.255", "top_dest": "10.0.1.10", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 199", "deny udp 10.0.20.0 0.0.255.255 host 10.0.1.10", "exit", "interface Vlan50", "ip access-group 199 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "critical", "acl": 199, "interface": "Vlan99", "direction": "in", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan99", "acl": 199, "direction": "in", "misconfig_type": "direction", "symptom": "unexpected permit"}], "cli_fix": ["interface Vlan99", "no ip access-group 199 in", "no ip access-group 199 out", "ip access-group 199 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 100, "interface": "Vlan40", "direction": "in", "src": "10.0.10.0 0.0.0.63", "dst": "10.0.2.20", "service": "tcp/123", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan40", "acl": 100, "direction": "in", "deny_hits": 5000, "existing_rules_hint": ["deny tcp 10.0.10.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 100", "permit tcp 10.0.10.0 0.0.0.63 host 10.0.2.20 eq 123", "exit", "interface Vlan40", "ip access-group 100 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "medium", "acl": 120, "interface": "Vlan40", "direction": "in", "src": "192.168.1.0 0.0.0.255", "dst": "10.0.2.20", "service": "tcp/80", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan40", "acl": 120, "direction": "in", "deny_hits": 200, "existing_rules_hint": ["deny tcp 192.168.1.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 120", "permit tcp 192.168.1.0 0.0.0.255 host 10.0.2.20 eq 80", "exit", "interface Vlan40", "ip access-group 120 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "medium", "acl": 199, "interface": "GigabitEthernet0/2", "direction": "out", "src": "10.0.40.0 0.0.0.63", "dst": "10.0.2.20", "service": "udp/443", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/2", "acl": 199, "direction": "out", "deny_hits": 500, "existing_rules_hint": ["deny udp 10.0.40.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit udp 10.0.40.0 0.0.0.63 host 10.0.2.20 eq 443", "exit", "interface GigabitEthernet0/2", "ip access-group 199 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "high", "acl": 150, "interface": "Vlan40", "direction": "out", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan40", "acl": 150, "direction": "out", "deny_rate": 200, "top_source": "192.168.1.0 0.0.0.255", "top_dest": "198.51.100.10", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 150", "permit tcp 192.168.1.0 0.0.0.255 host 198.51.100.10 eq 8080", "exit", "interface Vlan40", "ip access-group 150 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 110, "interface": "Vlan99", "direction": "out", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan99", "acl": 110, "direction": "out", "deny_rate": 200, "top_source": "172.16.10.0 0.0.0.63", "top_dest": "10.0.2.20", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 110", "permit tcp 172.16.10.0 0.0.0.63 host 10.0.2.20 eq 8080", "exit", "interface Vlan99", "ip access-group 110 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "medium", "acl": 110, "interface": "Vlan10", "direction": "in", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan10", "acl": 110, "direction": "in", "misconfig_type": "direction", "symptom": "unexpected permit"}], "cli_fix": ["interface Vlan10", "no ip access-group 110 in", "no ip access-group 110 out", "ip access-group 110 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 110, "interface": "Vlan40", "direction": "out", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan40", "acl": 110, "direction": "out", "deny_rate": 5000, "top_source": "10.0.40.0 0.0.0.63", "top_dest": "10.0.3.30", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 110", "permit tcp 10.0.40.0 0.0.0.63 host 10.0.3.30 eq 161", "exit", "interface Vlan40", "ip access-group 110 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 120, "interface": "GigabitEthernet0/1", "direction": "in", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "acl": 120, "direction": "in", "deny_rate": 5000, "top_source": "172.16.10.0 0.0.255.255", "top_dest": "203.0.113.50", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 120", "deny udp 172.16.10.0 0.0.255.255 host 203.0.113.50", "exit", "interface GigabitEthernet0/1", "ip access-group 120 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "high", "acl": 100, "interface": "GigabitEthernet0/3", "direction": "in", "src": "192.168.1.0 0.0.0.255", "dst": "10.0.2.20", "service": "tcp/8080", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/3", "acl": 100, "direction": "in", "deny_hits": 500, "existing_rules_hint": ["deny tcp 192.168.1.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 100", "permit tcp 192.168.1.0 0.0.0.255 host 10.0.2.20 eq 8080", "exit", "interface GigabitEthernet0/3", "ip access-group 100 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "high", "acl": 101, "interface": "Vlan20", "direction": "in", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan20", "acl": 101, "direction": "in", "misconfig_type": "wildcard", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 101", "no deny udp 172.16.10.0 0.0.0.15 host 192.0.2.25 eq 3389", "deny udp 172.16.10.0 0.0.0.255 host 192.0.2.25 eq 3389", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "medium", "acl": 150, "interface": "Vlan50", "direction": "out", "src": "10.0.30.0 0.0.255.255", "dst": "10.0.2.20", "service": "udp/443", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan50", "acl": 150, "direction": "out", "deny_hits": 1200, "existing_rules_hint": ["deny udp 10.0.30.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 150", "permit udp 10.0.30.0 0.0.255.255 host 10.0.2.20 eq 443", "exit", "interface Vlan50", "ip access-group 150 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "high", "acl": 100, "interface": "GigabitEthernet0/2", "direction": "out", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "acl": 100, "direction": "out", "deny_rate": 200, "top_source": "192.168.1.0 0.0.255.255", "top_dest": "10.0.3.30", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 100", "permit tcp 192.168.1.0 0.0.255.255 host 10.0.3.30 eq 80", "exit", "interface GigabitEthernet0/2", "ip access-group 100 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "medium", "acl": 120, "interface": "GigabitEthernet0/1", "direction": "out", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/1", "acl": 120, "direction": "out", "deny_rate": 500, "top_source": "10.0.30.0 0.0.0.15", "top_dest": "10.0.3.30", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 120", "deny icmp 10.0.30.0 0.0.0.15 host 10.0.3.30", "exit", "interface GigabitEthernet0/1", "ip access-group 120 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "critical", "acl": 120, "interface": "Vlan20", "direction": "in", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan20", "acl": 120, "direction": "in", "misconfig_type": "protocol", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 120", "no deny tcp 10.0.10.0 0.0.0.255 host 10.0.2.20 eq 23", "deny udp 10.0.10.0 0.0.0.255 host 10.0.2.20 eq 23", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "high", "acl": 101, "interface": "Vlan20", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan20", "acl": 101, "direction": "in", "deny_rate": 500, "top_source": "192.168.1.0 0.0.0.15", "top_dest": "10.0.2.20", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 101", "permit tcp 192.168.1.0 0.0.0.15 host 10.0.2.20 eq 53", "exit", "interface Vlan20", "ip access-group 101 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "medium", "acl": 199, "interface": "Vlan30", "direction": "in", "src": "192.168.1.0 0.0.255.255", "dst": "10.0.1.10", "service": "tcp/22", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan30", "acl": 199, "direction": "in", "deny_hits": 5000, "existing_rules_hint": ["deny tcp 192.168.1.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit tcp 192.168.1.0 0.0.255.255 host 10.0.1.10 eq 22", "exit", "interface Vlan30", "ip access-group 199 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "high", "acl": 100, "interface": "Vlan50", "direction": "in", "src": "10.0.30.0 0.0.0.255", "dst": "192.0.2.25", "service": "tcp/80", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan50", "acl": 100, "direction": "in", "deny_hits": 5000, "existing_rules_hint": ["deny tcp 10.0.30.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 100", "permit tcp 10.0.30.0 0.0.0.255 host 192.0.2.25 eq 80", "exit", "interface Vlan50", "ip access-group 100 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "high", "acl": 150, "interface": "Vlan99", "direction": "out", "src": "192.168.1.0 0.0.0.255", "dst": "192.0.2.25", "service": "tcp/8080", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan99", "acl": 150, "direction": "out", "deny_hits": 200, "existing_rules_hint": ["deny tcp 192.168.1.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 150", "permit tcp 192.168.1.0 0.0.0.255 host 192.0.2.25 eq 8080", "exit", "interface Vlan99", "ip access-group 150 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "critical", "acl": 101, "interface": "Vlan50", "direction": "out", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan50", "acl": 101, "direction": "out", "misconfig_type": "wildcard", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 101", "no deny udp 10.0.30.0 0.0.0.255 host 10.0.3.30 eq 23", "deny udp 10.0.30.0 0.0.0.15 host 10.0.3.30 eq 23", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 120, "interface": "Vlan30", "direction": "in", "src": "10.0.30.0 0.0.255.255", "dst": "10.0.3.30", "service": "tcp/3389", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan30", "acl": 120, "direction": "in", "deny_hits": 5000, "existing_rules_hint": ["deny tcp 10.0.30.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 120", "permit tcp 10.0.30.0 0.0.255.255 host 10.0.3.30 eq 3389", "exit", "interface Vlan30", "ip access-group 120 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "high", "acl": 100, "interface": "Vlan40", "direction": "in", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan40", "acl": 100, "direction": "in", "misconfig_type": "wildcard", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 100", "no deny tcp 192.168.1.0 0.0.0.63 host 10.0.3.30 eq 123", "deny tcp 192.168.1.0 0.0.255.255 host 10.0.3.30 eq 123", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "high", "acl": 101, "interface": "GigabitEthernet0/2", "direction": "out", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "acl": 101, "direction": "out", "deny_rate": 500, "top_source": "192.168.1.0 0.0.0.15", "top_dest": "10.0.2.20", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 101", "deny icmp 192.168.1.0 0.0.0.15 host 10.0.2.20", "exit", "interface GigabitEthernet0/2", "ip access-group 101 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "high", "acl": 100, "interface": "GigabitEthernet0/0", "direction": "out", "src": "172.16.10.0 0.0.255.255", "dst": "10.0.2.20", "service": "tcp/22", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/0", "acl": 100, "direction": "out", "deny_hits": 500, "existing_rules_hint": ["deny tcp 172.16.10.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 100", "permit tcp 172.16.10.0 0.0.255.255 host 10.0.2.20 eq 22", "exit", "interface GigabitEthernet0/0", "ip access-group 100 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "high", "acl": 110, "interface": "GigabitEthernet0/2", "direction": "out", "src": "192.168.1.0 0.0.0.255", "dst": "192.0.2.25", "service": "tcp/514", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/2", "acl": 110, "direction": "out", "deny_hits": 5000, "existing_rules_hint": ["deny tcp 192.168.1.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit tcp 192.168.1.0 0.0.0.255 host 192.0.2.25 eq 514", "exit", "interface GigabitEthernet0/2", "ip access-group 110 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "high", "acl": 199, "interface": "Vlan20", "direction": "in", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan20", "acl": 199, "direction": "in", "misconfig_type": "protocol", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 199", "no deny udp 10.0.30.0 0.0.255.255 host 10.0.1.10 eq 443", "deny tcp 10.0.30.0 0.0.255.255 host 10.0.1.10 eq 443", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 101, "interface": "Vlan30", "direction": "in", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan30", "acl": 101, "direction": "in", "deny_rate": 500, "top_source": "10.0.30.0 0.0.0.15", "top_dest": "10.0.3.30", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 101", "deny tcp 10.0.30.0 0.0.0.15 host 10.0.3.30", "exit", "interface Vlan30", "ip access-group 101 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "high", "acl": 110, "interface": "GigabitEthernet0/1", "direction": "in", "src": "10.0.20.0 0.0.0.255", "dst": "10.0.3.30", "service": "udp/443", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/1", "acl": 110, "direction": "in", "deny_hits": 200, "existing_rules_hint": ["deny udp 10.0.20.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 110", "permit udp 10.0.20.0 0.0.0.255 host 10.0.3.30 eq 443", "exit", "interface GigabitEthernet0/1", "ip access-group 110 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "critical", "acl": 120, "interface": "GigabitEthernet0/0", "direction": "in", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "acl": 120, "direction": "in", "misconfig_type": "direction", "symptom": "policy not applied"}], "cli_fix": ["interface GigabitEthernet0/0", "no ip access-group 120 in", "no ip access-group 120 out", "ip access-group 120 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "high", "acl": 150, "interface": "Vlan20", "direction": "out", "src": "10.0.30.0 0.0.0.255", "dst": "198.51.100.10", "service": "tcp/80", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan20", "acl": 150, "direction": "out", "deny_hits": 5000, "existing_rules_hint": ["deny tcp 10.0.30.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 150", "permit tcp 10.0.30.0 0.0.0.255 host 198.51.100.10 eq 80", "exit", "interface Vlan20", "ip access-group 150 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "medium", "acl": 101, "interface": "Vlan10", "direction": "out", "src": "10.0.10.0 0.0.0.255", "dst": "10.0.1.10", "service": "udp/53", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan10", "acl": 101, "direction": "out", "deny_hits": 200, "existing_rules_hint": ["deny udp 10.0.10.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 101", "permit udp 10.0.10.0 0.0.0.255 host 10.0.1.10 eq 53", "exit", "interface Vlan10", "ip access-group 101 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "high", "acl": 199, "interface": "GigabitEthernet0/0", "direction": "in", "src": "10.0.40.0 0.0.255.255", "dst": "198.51.100.10", "service": "udp/23", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/0", "acl": 199, "direction": "in", "deny_hits": 1200, "existing_rules_hint": ["deny udp 10.0.40.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit udp 10.0.40.0 0.0.255.255 host 198.51.100.10 eq 23", "exit", "interface GigabitEthernet0/0", "ip access-group 199 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "high", "acl": 199, "interface": "GigabitEthernet0/2", "direction": "in", "src": "10.0.40.0 0.0.255.255", "dst": "192.0.2.25", "service": "udp/161", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/2", "acl": 199, "direction": "in", "deny_hits": 5000, "existing_rules_hint": ["deny udp 10.0.40.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit udp 10.0.40.0 0.0.255.255 host 192.0.2.25 eq 161", "exit", "interface GigabitEthernet0/2", "ip access-group 199 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "high", "acl": 199, "interface": "Vlan20", "direction": "in", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan20", "acl": 199, "direction": "in", "deny_rate": 500, "top_source": "192.168.1.0 0.0.255.255", "top_dest": "198.51.100.10", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 199", "permit tcp 192.168.1.0 0.0.255.255 host 198.51.100.10 eq 514", "exit", "interface Vlan20", "ip access-group 199 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "critical", "acl": 110, "interface": "Vlan20", "direction": "in", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan20", "acl": 110, "direction": "in", "misconfig_type": "wildcard", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 110", "no deny udp 10.0.10.0 0.0.255.255 host 198.51.100.10 eq 53", "deny udp 10.0.10.0 0.0.0.255 host 198.51.100.10 eq 53", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "medium", "acl": 120, "interface": "GigabitEthernet0/1", "direction": "out", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/1", "acl": 120, "direction": "out", "misconfig_type": "wildcard", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 120", "no deny tcp 172.16.10.0 0.0.0.255 host 192.0.2.25 eq 161", "deny tcp 172.16.10.0 0.0.255.255 host 192.0.2.25 eq 161", "exit"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 110, "interface": "Vlan30", "direction": "out", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan30", "acl": 110, "direction": "out", "deny_rate": 200, "top_source": "10.0.40.0 0.0.0.255", "top_dest": "10.0.2.20", "top_proto": "icmp"}], "cli_fix": ["ip access-list extended 110", "deny icmp 10.0.40.0 0.0.0.255 host 10.0.2.20", "exit", "interface Vlan30", "ip access-group 110 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "medium", "acl": 110, "interface": "Vlan40", "direction": "in", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan40", "acl": 110, "direction": "in", "misconfig_type": "direction", "symptom": "unexpected permit"}], "cli_fix": ["interface Vlan40", "no ip access-group 110 in", "no ip access-group 110 out", "ip access-group 110 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "high", "acl": 100, "interface": "Vlan40", "direction": "in", "deny_rate": "200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan40", "acl": 100, "direction": "in", "deny_rate": 200, "top_source": "10.0.40.0 0.0.0.63", "top_dest": "10.0.2.20", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 100", "deny tcp 10.0.40.0 0.0.0.63 host 10.0.2.20", "exit", "interface Vlan40", "ip access-group 100 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 150, "interface": "Vlan99", "direction": "in", "src": "10.0.20.0 0.0.0.63", "dst": "203.0.113.50", "service": "udp/123", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan99", "acl": 150, "direction": "in", "deny_hits": 5000, "existing_rules_hint": ["deny udp 10.0.20.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 150", "permit udp 10.0.20.0 0.0.0.63 host 203.0.113.50 eq 123", "exit", "interface Vlan99", "ip access-group 150 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "high", "acl": 100, "interface": "GigabitEthernet0/0", "direction": "out", "src": "10.0.40.0 0.0.0.15", "dst": "10.0.1.10", "service": "tcp/514", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "acl": 100, "direction": "out", "deny_hits": 500, "existing_rules_hint": ["deny tcp 10.0.40.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 100", "permit tcp 10.0.40.0 0.0.0.15 host 10.0.1.10 eq 514", "exit", "interface GigabitEthernet0/0", "ip access-group 100 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 150, "interface": "GigabitEthernet0/2", "direction": "out", "deny_rate": "500/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "acl": 150, "direction": "out", "deny_rate": 500, "top_source": "10.0.10.0 0.0.0.15", "top_dest": "203.0.113.50", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 150", "deny tcp 10.0.10.0 0.0.0.15 host 203.0.113.50", "exit", "interface GigabitEthernet0/2", "ip access-group 150 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "critical", "acl": 199, "interface": "GigabitEthernet0/3", "direction": "in", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/3", "acl": 199, "direction": "in", "misconfig_type": "protocol", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 199", "no deny tcp 10.0.10.0 0.0.255.255 host 192.0.2.25 eq 53", "deny udp 10.0.10.0 0.0.255.255 host 192.0.2.25 eq 53", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "medium", "acl": 150, "interface": "GigabitEthernet0/3", "direction": "out", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/3", "acl": 150, "direction": "out", "misconfig_type": "protocol", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 150", "no deny udp 192.168.1.0 0.0.0.15 host 192.0.2.25 eq 23", "deny tcp 192.168.1.0 0.0.0.15 host 192.0.2.25 eq 23", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "critical", "acl": 101, "interface": "Vlan50", "direction": "out", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "Vlan50", "acl": 101, "direction": "out", "misconfig_type": "direction", "symptom": "unexpected permit"}], "cli_fix": ["interface Vlan50", "no ip access-group 101 in", "no ip access-group 101 out", "ip access-group 101 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "medium", "acl": 199, "interface": "GigabitEthernet0/0", "direction": "out", "src": "10.0.10.0 0.0.0.15", "dst": "192.0.2.25", "service": "tcp/3389", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/0", "acl": 199, "direction": "out", "deny_hits": 200, "existing_rules_hint": ["deny tcp 10.0.10.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit tcp 10.0.10.0 0.0.0.15 host 192.0.2.25 eq 3389", "exit", "interface GigabitEthernet0/0", "ip access-group 199 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "high", "acl": 101, "interface": "Vlan99", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan99", "acl": 101, "direction": "out", "deny_rate": 1200, "top_source": "172.16.10.0 0.0.0.255", "top_dest": "192.0.2.25", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 101", "deny tcp 172.16.10.0 0.0.0.255 host 192.0.2.25", "exit", "interface Vlan99", "ip access-group 101 out"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "high", "acl": 101, "interface": "GigabitEthernet0/0", "direction": "in", "misconfig_type": "direction", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "BRANCH-RTR1", "interface": "GigabitEthernet0/0", "acl": 101, "direction": "in", "misconfig_type": "direction", "symptom": "unexpected deny"}], "cli_fix": ["interface GigabitEthernet0/0", "no ip access-group 101 in", "no ip access-group 101 out", "ip access-group 101 in"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "critical", "acl": 150, "interface": "GigabitEthernet0/2", "direction": "in", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "acl": 150, "direction": "in", "misconfig_type": "wildcard", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 150", "no deny tcp 192.168.1.0 0.0.0.255 host 10.0.2.20 eq 8080", "deny tcp 192.168.1.0 0.0.0.63 host 10.0.2.20 eq 8080", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "EDGE-FW1", "severity": "high", "acl": 101, "interface": "Vlan10", "direction": "in", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan10", "acl": 101, "direction": "in", "misconfig_type": "wildcard", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 101", "no deny tcp 192.168.1.0 0.0.0.63 host 198.51.100.10 eq 53", "deny tcp 192.168.1.0 0.0.255.255 host 198.51.100.10 eq 53", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "CORE-R1", "severity": "high", "acl": 120, "interface": "GigabitEthernet0/2", "direction": "in", "misconfig_type": "wildcard", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "EDGE-FW1", "interface": "GigabitEthernet0/2", "acl": 120, "direction": "in", "misconfig_type": "wildcard", "symptom": "policy not applied"}], "cli_fix": ["ip access-list extended 120", "no deny tcp 10.0.10.0 0.0.0.255 host 192.0.2.25 eq 161", "deny tcp 10.0.10.0 0.0.255.255 host 192.0.2.25 eq 161", "exit"]}
{"incident_type": "acl_misconfiguration", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Correct the specific misconfiguration (wildcard/protocol/direction) with minimal change", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL misconfiguration detected", "device": "BRANCH-RTR1", "severity": "high", "acl": 110, "interface": "GigabitEthernet0/2", "direction": "out", "misconfig_type": "protocol", "description": "ACL rule or placement inconsistent with intended policy; traffic behavior unexpected."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/2", "acl": 110, "direction": "out", "misconfig_type": "protocol", "symptom": "unexpected deny"}], "cli_fix": ["ip access-list extended 110", "no deny udp 10.0.20.0 0.0.0.63 host 10.0.3.30 eq 514", "deny tcp 10.0.20.0 0.0.0.63 host 10.0.3.30 eq 514", "exit"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "CORE-R1", "severity": "high", "acl": 199, "interface": "Vlan99", "direction": "out", "src": "10.0.30.0 0.0.0.15", "dst": "192.0.2.25", "service": "udp/161", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan99", "acl": 199, "direction": "out", "deny_hits": 200, "existing_rules_hint": ["deny udp 10.0.30.0 0.0.0.15 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit udp 10.0.30.0 0.0.0.15 host 192.0.2.25 eq 161", "exit", "interface Vlan99", "ip access-group 199 out"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "high", "acl": 101, "interface": "GigabitEthernet0/0", "direction": "out", "src": "192.168.1.0 0.0.0.255", "dst": "192.0.2.25", "service": "udp/8080", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "GigabitEthernet0/0", "acl": 101, "direction": "out", "deny_hits": 200, "existing_rules_hint": ["deny udp 192.168.1.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 101", "permit udp 192.168.1.0 0.0.0.255 host 192.0.2.25 eq 8080", "exit", "interface GigabitEthernet0/0", "ip access-group 101 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "high", "acl": 199, "interface": "Vlan30", "direction": "in", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan30", "acl": 199, "direction": "in", "deny_rate": 5000, "top_source": "10.0.20.0 0.0.255.255", "top_dest": "203.0.113.50", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 199", "permit tcp 10.0.20.0 0.0.255.255 host 203.0.113.50 eq 443", "exit", "interface Vlan30", "ip access-group 199 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "BRANCH-RTR1", "severity": "medium", "acl": 120, "interface": "Vlan40", "direction": "out", "src": "192.168.1.0 0.0.0.63", "dst": "10.0.3.30", "service": "tcp/80", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan40", "acl": 120, "direction": "out", "deny_hits": 1200, "existing_rules_hint": ["deny tcp 192.168.1.0 0.0.0.63 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 120", "permit tcp 192.168.1.0 0.0.0.63 host 10.0.3.30 eq 80", "exit", "interface Vlan40", "ip access-group 120 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "medium", "acl": 150, "interface": "Vlan40", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan40", "acl": 150, "direction": "out", "deny_rate": 1200, "top_source": "10.0.10.0 0.0.0.63", "top_dest": "10.0.1.10", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 150", "deny udp 10.0.10.0 0.0.0.63 host 10.0.1.10", "exit", "interface Vlan40", "ip access-group 150 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "EDGE-FW1", "severity": "high", "acl": 101, "interface": "Vlan20", "direction": "in", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "CORE-R1", "interface": "Vlan20", "acl": 101, "direction": "in", "deny_rate": 1200, "top_source": "10.0.10.0 0.0.0.63", "top_dest": "198.51.100.10", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 101", "deny udp 10.0.10.0 0.0.0.63 host 198.51.100.10", "exit", "interface Vlan20", "ip access-group 101 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "medium", "acl": 199, "interface": "Vlan40", "direction": "in", "src": "192.168.1.0 0.0.0.255", "dst": "10.0.3.30", "service": "udp/3389", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "EDGE-FW1", "interface": "Vlan40", "acl": 199, "direction": "in", "deny_hits": 500, "existing_rules_hint": ["deny udp 192.168.1.0 0.0.0.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 199", "permit udp 192.168.1.0 0.0.0.255 host 10.0.3.30 eq 3389", "exit", "interface Vlan40", "ip access-group 199 in"]}
{"incident_type": "acl_blocking_legitimate_traffic", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Prefer minimal change: add specific permit rather than removing security controls", "Do NOT provide explanation"], "wazuh_alert": {"rule": "ACL blocking legitimate traffic", "device": "EDGE-FW1", "severity": "medium", "acl": 120, "interface": "Vlan99", "direction": "out", "src": "10.0.20.0 0.0.255.255", "dst": "10.0.3.30", "service": "tcp/161", "description": "High deny count for known legitimate flow; business traffic impacted."}, "devices": [{"name": "CORE-R1", "interface": "Vlan99", "acl": 120, "direction": "out", "deny_hits": 500, "existing_rules_hint": ["deny tcp 10.0.20.0 0.0.255.255 any", "deny ip any any log"]}], "cli_fix": ["ip access-list extended 120", "permit tcp 10.0.20.0 0.0.255.255 host 10.0.3.30 eq 161", "exit", "interface Vlan99", "ip access-group 120 out"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "BRANCH-RTR1", "severity": "high", "acl": 110, "interface": "Vlan20", "direction": "in", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan20", "acl": 110, "direction": "in", "deny_rate": 200, "top_source": "10.0.20.0 0.0.255.255", "top_dest": "198.51.100.10", "top_proto": "udp"}], "cli_fix": ["ip access-list extended 110", "deny udp 10.0.20.0 0.0.255.255 host 198.51.100.10", "exit", "interface Vlan20", "ip access-group 110 in"]}
{"incident_type": "excessive_deny_entries", "instruction": "Analyze ACL incidents and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Output ONLY valid Cisco IOS/IOS-XE CLI commands", "Do NOT include show/debug commands", "Reduce excessive deny noise by adding specific rule(s) rather than broad allow/deny", "Do NOT provide explanation"], "wazuh_alert": {"rule": "Excessive ACL deny entries", "device": "CORE-R1", "severity": "high", "acl": 199, "interface": "Vlan50", "direction": "out", "deny_rate": "1200/s", "description": "ACL deny logs indicate abnormal volume; potential scan/noise impacting monitoring and CPU."}, "devices": [{"name": "BRANCH-RTR1", "interface": "Vlan50", "acl": 199, "direction": "out", "deny_rate": 1200, "top_source": "10.0.10.0 0.0.0.255", "top_dest": "203.0.113.50", "top_proto": "tcp"}], "cli_fix": ["ip access-list extended 199", "deny tcp 10.0.10.0 0.0.0.255 host 203.0.113.50", "exit", "interface Vlan50", "ip access-group 199 out"]}