{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "203.0.113.45"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 203.0.113.45", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "192.0.2.88"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 192.0.2.88", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "failed_login_attempts", "context": {"affected_plane": "management", "protocol": "AUTH", "confidence": "medium"}, "wazuh_alert": {"rule": "Excessive failed login attempts"}, "decision_constraints": {"allowed": ["login_block", "auth_logging"], "disallowed": ["acl_config", "snmp_config"]}, "cli_fix": ["login block-for 60 attempts 3 within 60", "login on-failure log", "login on-success log"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "198.51.100.77"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 198.51.100.77", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "snmp_bruteforce", "context": {"affected_plane": "management", "protocol": "SNMP", "confidence": "high"}, "wazuh_alert": {"rule": "SNMP brute force detected"}, "decision_constraints": {"allowed": ["snmp_v3_only"], "disallowed": ["vty_config", "ssh_config"]}, "cli_fix": ["no snmp-server community private", "snmp-server group SECURE v3 priv", "snmp-server user monitor SECURE v3 auth sha AUTHKEY priv aes 128 PRIVKEY"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}
{"incident_type": "ssh_bruteforce", "context": {"affected_plane": "management", "protocol": "SSH", "confidence": "high"}, "wazuh_alert": {"rule": "SSH brute force detected", "source_ip": "10.10.10.5"}, "decision_constraints": {"allowed": ["vt_access_class", "login_block"], "disallowed": ["snmp_config", "console_config", "acl_delete"]}, "cli_fix": ["ip access-list standard MGMT_SSH", "deny host 10.10.10.5", "permit any", "exit", "line vty 0 4", "access-class MGMT_SSH in", "login block-for 60 attempts 3 within 60"]}