{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T04:47:26.015809Z", "process": "ospf", "pid": 3113, "crash_count_24h": 6, "last_crash_reason": "Segmentation fault", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "ospf", "pid": 3113, "crash_count_24h": 6, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T04:58:26.009251Z", "memory_used_percent": 95, "memory_free_mb": 339, "memory_total_mb": 8192, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 95, "memory_free_mb": 339, "memory_total_mb": 8192, "top_consumer": "netconf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:13:26.009797Z", "memory_used_percent": 92, "memory_free_mb": 196, "memory_total_mb": 1024, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "memory_used_percent": 92, "memory_free_mb": 196, "memory_total_mb": 1024, "top_consumer": "bgp"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T02:22:26.005622Z", "cpu_5s_percent": 90, "cpu_1m_percent": 99, "cpu_5m_percent": 73, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "cpu_5s_percent": 90, "cpu_1m_percent": 99, "cpu_5m_percent": 73, "top_process": "QoS Stats"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T10:48:26.006831Z", "cpu_5s_percent": 93, "cpu_1m_percent": 90, "cpu_5m_percent": 85, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 93, "cpu_1m_percent": 90, "cpu_5m_percent": 85, "top_process": "SNMP ENGINE"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T08:20:26.016182Z", "process": "snmpd", "pid": 3020, "crash_count_24h": 22, "last_crash_reason": "Unhandled exception", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 3020, "crash_count_24h": 22, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:51:26.008894Z", "memory_used_percent": 93, "memory_free_mb": 108, "memory_total_mb": 2048, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 93, "memory_free_mb": 108, "memory_total_mb": 2048, "top_consumer": "logging"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T04:24:26.007807Z", "cpu_5s_percent": 97, "cpu_1m_percent": 86, "cpu_5m_percent": 67, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 97, "cpu_1m_percent": 86, "cpu_5m_percent": 67, "top_process": "QoS Stats"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:33:26.012643Z", "process": "netconf", "pid": 2703, "crash_count_24h": 20, "last_crash_reason": "Unhandled exception", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "netconf", "pid": 2703, "crash_count_24h": 20, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:45:26.004978Z", "cpu_5s_percent": 90, "cpu_1m_percent": 95, "cpu_5m_percent": 78, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 90, "cpu_1m_percent": 95, "cpu_5m_percent": 78, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:12:26.008252Z", "cpu_5s_percent": 91, "cpu_1m_percent": 86, "cpu_5m_percent": 80, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 91, "cpu_1m_percent": 86, "cpu_5m_percent": 80, "top_process": "BGP Scanner"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T03:05:26.010171Z", "memory_used_percent": 98, "memory_free_mb": 55, "memory_total_mb": 2048, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "memory_used_percent": 98, "memory_free_mb": 55, "memory_total_mb": 2048, "top_consumer": "crypto"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T10:56:26.005923Z", "cpu_5s_percent": 98, "cpu_1m_percent": 98, "cpu_5m_percent": 83, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 98, "cpu_1m_percent": 98, "cpu_5m_percent": 83, "top_process": "Crypto IKEv2"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T08:24:26.015819Z", "process": "snmpd", "pid": 2664, "crash_count_24h": 9, "last_crash_reason": "Memory corruption", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 2664, "crash_count_24h": 9, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T04:59:26.008007Z", "cpu_5s_percent": 87, "cpu_1m_percent": 77, "cpu_5m_percent": 74, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 87, "cpu_1m_percent": 77, "cpu_5m_percent": 74, "top_process": "IP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T11:11:26.005496Z", "cpu_5s_percent": 91, "cpu_1m_percent": 92, "cpu_5m_percent": 89, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 91, "cpu_1m_percent": 92, "cpu_5m_percent": 89, "top_process": "BGP Scanner"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T11:07:26.013803Z", "process": "ospf", "pid": 3436, "crash_count_24h": 7, "last_crash_reason": "Unhandled exception", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "ospf", "pid": 3436, "crash_count_24h": 7, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:00:26.007968Z", "cpu_5s_percent": 85, "cpu_1m_percent": 96, "cpu_5m_percent": 69, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 85, "cpu_1m_percent": 96, "cpu_5m_percent": 69, "top_process": "ARP Input"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:19:26.008105Z", "cpu_5s_percent": 87, "cpu_1m_percent": 86, "cpu_5m_percent": 68, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 87, "cpu_1m_percent": 86, "cpu_5m_percent": 68, "top_process": "CEF RP"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T06:46:26.013874Z", "process": "crypto", "pid": 594, "crash_count_24h": 13, "last_crash_reason": "Unhandled exception", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "crypto", "pid": 594, "crash_count_24h": 13, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T07:58:26.015945Z", "process": "snmpd", "pid": 3858, "crash_count_24h": 7, "last_crash_reason": "Segmentation fault", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "snmpd", "pid": 3858, "crash_count_24h": 7, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T02:04:26.013376Z", "process": "telemetry", "pid": 385, "crash_count_24h": 4, "last_crash_reason": "Watchdog timeout", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "telemetry", "pid": 385, "crash_count_24h": 4, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T01:37:26.008710Z", "memory_used_percent": 80, "memory_free_mb": 201, "memory_total_mb": 2048, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 80, "memory_free_mb": 201, "memory_total_mb": 2048, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T10:32:26.014283Z", "process": "netconf", "pid": 2761, "crash_count_24h": 12, "last_crash_reason": "Watchdog timeout", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "netconf", "pid": 2761, "crash_count_24h": 12, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T02:11:26.010948Z", "memory_used_percent": 90, "memory_free_mb": 421, "memory_total_mb": 8192, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 90, "memory_free_mb": 421, "memory_total_mb": 8192, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T02:21:26.010120Z", "memory_used_percent": 99, "memory_free_mb": 110, "memory_total_mb": 4096, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 99, "memory_free_mb": 110, "memory_total_mb": 4096, "top_consumer": "crypto"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T01:57:26.009625Z", "memory_used_percent": 88, "memory_free_mb": 343, "memory_total_mb": 1024, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 88, "memory_free_mb": 343, "memory_total_mb": 1024, "top_consumer": "telemetry"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T02:01:26.007303Z", "cpu_5s_percent": 99, "cpu_1m_percent": 81, "cpu_5m_percent": 73, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 99, "cpu_1m_percent": 81, "cpu_5m_percent": 73, "top_process": "ARP Input"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T04:43:26.015772Z", "process": "snmpd", "pid": 2845, "crash_count_24h": 20, "last_crash_reason": "Memory corruption", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 2845, "crash_count_24h": 20, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T02:46:26.009094Z", "memory_used_percent": 96, "memory_free_mb": 173, "memory_total_mb": 8192, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 96, "memory_free_mb": 173, "memory_total_mb": 8192, "top_consumer": "ospf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:47:26.013679Z", "process": "iosd", "pid": 1172, "crash_count_24h": 13, "last_crash_reason": "Segmentation fault", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "process": "iosd", "pid": 1172, "crash_count_24h": 13, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T07:43:26.007587Z", "cpu_5s_percent": 85, "cpu_1m_percent": 91, "cpu_5m_percent": 69, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 85, "cpu_1m_percent": 91, "cpu_5m_percent": 69, "top_process": "SSH Process"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T07:10:26.011048Z", "memory_used_percent": 95, "memory_free_mb": 457, "memory_total_mb": 8192, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "memory_used_percent": 95, "memory_free_mb": 457, "memory_total_mb": 8192, "top_consumer": "snmp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T05:54:26.011277Z", "memory_used_percent": 97, "memory_free_mb": 151, "memory_total_mb": 4096, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 97, "memory_free_mb": 151, "memory_total_mb": 4096, "top_consumer": "snmp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T06:43:26.010503Z", "memory_used_percent": 96, "memory_free_mb": 260, "memory_total_mb": 1024, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "memory_used_percent": 96, "memory_free_mb": 260, "memory_total_mb": 1024, "top_consumer": "logging"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T04:51:26.008748Z", "memory_used_percent": 89, "memory_free_mb": 87, "memory_total_mb": 4096, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 89, "memory_free_mb": 87, "memory_total_mb": 4096, "top_consumer": "cef"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:37:26.006586Z", "cpu_5s_percent": 91, "cpu_1m_percent": 94, "cpu_5m_percent": 84, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "cpu_5s_percent": 91, "cpu_1m_percent": 94, "cpu_5m_percent": 84, "top_process": "IP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:05:26.014312Z", "process": "bgp", "pid": 1288, "crash_count_24h": 16, "last_crash_reason": "Memory corruption", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "process": "bgp", "pid": 1288, "crash_count_24h": 16, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:08:26.007189Z", "cpu_5s_percent": 87, "cpu_1m_percent": 98, "cpu_5m_percent": 93, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "cpu_5s_percent": 87, "cpu_1m_percent": 98, "cpu_5m_percent": 93, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:50:26.014177Z", "process": "ospf", "pid": 4375, "crash_count_24h": 13, "last_crash_reason": "Watchdog timeout", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "ospf", "pid": 4375, "crash_count_24h": 13, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T06:06:26.015593Z", "process": "ospf", "pid": 1248, "crash_count_24h": 16, "last_crash_reason": "Memory corruption", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "ospf", "pid": 1248, "crash_count_24h": 16, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:38:26.012948Z", "process": "snmpd", "pid": 3915, "crash_count_24h": 21, "last_crash_reason": "Unhandled exception", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 3915, "crash_count_24h": 21, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:44:26.012332Z", "memory_used_percent": 91, "memory_free_mb": 338, "memory_total_mb": 1024, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 91, "memory_free_mb": 338, "memory_total_mb": 1024, "top_consumer": "ospf"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T04:49:26.008971Z", "memory_used_percent": 96, "memory_free_mb": 54, "memory_total_mb": 1024, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 96, "memory_free_mb": 54, "memory_total_mb": 1024, "top_consumer": "cef"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T01:37:26.011785Z", "memory_used_percent": 85, "memory_free_mb": 440, "memory_total_mb": 2048, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 85, "memory_free_mb": 440, "memory_total_mb": 2048, "top_consumer": "logging"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:07:26.011632Z", "memory_used_percent": 93, "memory_free_mb": 220, "memory_total_mb": 4096, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 93, "memory_free_mb": 220, "memory_total_mb": 4096, "top_consumer": "telemetry"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T06:22:26.016276Z", "process": "ospf", "pid": 1007, "crash_count_24h": 21, "last_crash_reason": "Watchdog timeout", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "ospf", "pid": 1007, "crash_count_24h": 21, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:05:26.013496Z", "process": "ospf", "pid": 4510, "crash_count_24h": 15, "last_crash_reason": "Memory corruption", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "ospf", "pid": 4510, "crash_count_24h": 15, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:29:26.009221Z", "memory_used_percent": 92, "memory_free_mb": 249, "memory_total_mb": 2048, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 92, "memory_free_mb": 249, "memory_total_mb": 2048, "top_consumer": "crypto"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T04:44:26.009050Z", "memory_used_percent": 94, "memory_free_mb": 225, "memory_total_mb": 8192, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 94, "memory_free_mb": 225, "memory_total_mb": 8192, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:26:26.005154Z", "cpu_5s_percent": 94, "cpu_1m_percent": 95, "cpu_5m_percent": 68, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 94, "cpu_1m_percent": 95, "cpu_5m_percent": 68, "top_process": "SSH Process"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T08:08:26.008914Z", "memory_used_percent": 99, "memory_free_mb": 339, "memory_total_mb": 4096, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 99, "memory_free_mb": 339, "memory_total_mb": 4096, "top_consumer": "bgp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T02:09:26.006659Z", "cpu_5s_percent": 85, "cpu_1m_percent": 97, "cpu_5m_percent": 74, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 85, "cpu_1m_percent": 97, "cpu_5m_percent": 74, "top_process": "SSH Process"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T11:02:26.012243Z", "memory_used_percent": 96, "memory_free_mb": 377, "memory_total_mb": 4096, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 96, "memory_free_mb": 377, "memory_total_mb": 4096, "top_consumer": "telemetry"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T11:11:26.008182Z", "cpu_5s_percent": 93, "cpu_1m_percent": 98, "cpu_5m_percent": 81, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 93, "cpu_1m_percent": 98, "cpu_5m_percent": 81, "top_process": "Crypto IKEv2"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T04:47:26.005828Z", "cpu_5s_percent": 99, "cpu_1m_percent": 93, "cpu_5m_percent": 68, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "cpu_5s_percent": 99, "cpu_1m_percent": 93, "cpu_5m_percent": 68, "top_process": "BGP Scanner"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T08:21:26.016528Z", "process": "snmpd", "pid": 2661, "crash_count_24h": 24, "last_crash_reason": "Memory corruption", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "process": "snmpd", "pid": 2661, "crash_count_24h": 24, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T06:10:26.004614Z", "cpu_5s_percent": 98, "cpu_1m_percent": 77, "cpu_5m_percent": 77, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 98, "cpu_1m_percent": 77, "cpu_5m_percent": 77, "top_process": "QoS Stats"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T03:06:26.016238Z", "process": "telemetry", "pid": 4027, "crash_count_24h": 7, "last_crash_reason": "Memory corruption", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "process": "telemetry", "pid": 4027, "crash_count_24h": 7, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T02:54:26.011069Z", "memory_used_percent": 88, "memory_free_mb": 294, "memory_total_mb": 8192, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 88, "memory_free_mb": 294, "memory_total_mb": 8192, "top_consumer": "ospf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:12:26.007848Z", "cpu_5s_percent": 90, "cpu_1m_percent": 99, "cpu_5m_percent": 81, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 90, "cpu_1m_percent": 99, "cpu_5m_percent": 81, "top_process": "IP Input"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:39:26.012016Z", "memory_used_percent": 90, "memory_free_mb": 223, "memory_total_mb": 1024, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 90, "memory_free_mb": 223, "memory_total_mb": 1024, "top_consumer": "logging"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T05:04:26.014042Z", "process": "iosd", "pid": 4289, "crash_count_24h": 16, "last_crash_reason": "Unhandled exception", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "process": "iosd", "pid": 4289, "crash_count_24h": 16, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T07:40:26.005932Z", "cpu_5s_percent": 88, "cpu_1m_percent": 93, "cpu_5m_percent": 76, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "cpu_5s_percent": 88, "cpu_1m_percent": 93, "cpu_5m_percent": 76, "top_process": "QoS Stats"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:01:26.016301Z", "process": "ospf", "pid": 1710, "crash_count_24h": 13, "last_crash_reason": "Segmentation fault", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "ospf", "pid": 1710, "crash_count_24h": 13, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:34:26.011286Z", "memory_used_percent": 88, "memory_free_mb": 401, "memory_total_mb": 8192, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 88, "memory_free_mb": 401, "memory_total_mb": 8192, "top_consumer": "netconf"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:54:26.006408Z", "cpu_5s_percent": 88, "cpu_1m_percent": 88, "cpu_5m_percent": 72, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 88, "cpu_1m_percent": 88, "cpu_5m_percent": 72, "top_process": "QoS Stats"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T01:34:26.004452Z", "cpu_5s_percent": 95, "cpu_1m_percent": 96, "cpu_5m_percent": 83, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 95, "cpu_1m_percent": 96, "cpu_5m_percent": 83, "top_process": "IP Input"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T06:28:26.016518Z", "process": "bgp", "pid": 232, "crash_count_24h": 6, "last_crash_reason": "Watchdog timeout", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "process": "bgp", "pid": 232, "crash_count_24h": 6, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T01:54:26.006528Z", "cpu_5s_percent": 98, "cpu_1m_percent": 83, "cpu_5m_percent": 66, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 98, "cpu_1m_percent": 83, "cpu_5m_percent": 66, "top_process": "QoS Stats"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T04:22:26.014255Z", "process": "snmpd", "pid": 3592, "crash_count_24h": 9, "last_crash_reason": "Memory corruption", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "process": "snmpd", "pid": 3592, "crash_count_24h": 9, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T04:13:26.010199Z", "memory_used_percent": 98, "memory_free_mb": 245, "memory_total_mb": 4096, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 98, "memory_free_mb": 245, "memory_total_mb": 4096, "top_consumer": "netconf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:47:26.015034Z", "process": "snmpd", "pid": 4011, "crash_count_24h": 18, "last_crash_reason": "Memory corruption", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 4011, "crash_count_24h": 18, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T06:26:26.013954Z", "process": "bgp", "pid": 640, "crash_count_24h": 11, "last_crash_reason": "Memory corruption", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "process": "bgp", "pid": 640, "crash_count_24h": 11, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T05:16:26.006621Z", "cpu_5s_percent": 95, "cpu_1m_percent": 93, "cpu_5m_percent": 77, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 95, "cpu_1m_percent": 93, "cpu_5m_percent": 77, "top_process": "Net Background"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T09:19:26.012750Z", "process": "netconf", "pid": 3122, "crash_count_24h": 6, "last_crash_reason": "Memory corruption", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "netconf", "pid": 3122, "crash_count_24h": 6, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T05:33:26.008952Z", "memory_used_percent": 95, "memory_free_mb": 257, "memory_total_mb": 1024, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "memory_used_percent": 95, "memory_free_mb": 257, "memory_total_mb": 1024, "top_consumer": "logging"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T04:16:26.011574Z", "memory_used_percent": 99, "memory_free_mb": 454, "memory_total_mb": 4096, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 99, "memory_free_mb": 454, "memory_total_mb": 4096, "top_consumer": "snmp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T02:57:26.013916Z", "process": "ospf", "pid": 2484, "crash_count_24h": 2, "last_crash_reason": "Segmentation fault", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "process": "ospf", "pid": 2484, "crash_count_24h": 2, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T02:08:26.004900Z", "cpu_5s_percent": 85, "cpu_1m_percent": 96, "cpu_5m_percent": 87, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "cpu_5s_percent": 85, "cpu_1m_percent": 96, "cpu_5m_percent": 87, "top_process": "QoS Stats"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:22:26.011016Z", "memory_used_percent": 91, "memory_free_mb": 483, "memory_total_mb": 1024, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 91, "memory_free_mb": 483, "memory_total_mb": 1024, "top_consumer": "snmp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T07:50:26.007907Z", "cpu_5s_percent": 93, "cpu_1m_percent": 81, "cpu_5m_percent": 70, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 93, "cpu_1m_percent": 81, "cpu_5m_percent": 70, "top_process": "CEF RP"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T07:02:26.010806Z", "memory_used_percent": 94, "memory_free_mb": 456, "memory_total_mb": 2048, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 94, "memory_free_mb": 456, "memory_total_mb": 2048, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T08:32:26.007949Z", "cpu_5s_percent": 98, "cpu_1m_percent": 93, "cpu_5m_percent": 70, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 98, "cpu_1m_percent": 93, "cpu_5m_percent": 70, "top_process": "CEF RP"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:03:26.012341Z", "memory_used_percent": 82, "memory_free_mb": 449, "memory_total_mb": 4096, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "memory_used_percent": 82, "memory_free_mb": 449, "memory_total_mb": 4096, "top_consumer": "crypto"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T10:51:26.014999Z", "process": "iosd", "pid": 3579, "crash_count_24h": 17, "last_crash_reason": "Memory corruption", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "iosd", "pid": 3579, "crash_count_24h": 17, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T06:56:26.006549Z", "cpu_5s_percent": 98, "cpu_1m_percent": 98, "cpu_5m_percent": 92, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 98, "cpu_1m_percent": 98, "cpu_5m_percent": 92, "top_process": "Crypto IKEv2"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T04:03:26.005631Z", "cpu_5s_percent": 99, "cpu_1m_percent": 82, "cpu_5m_percent": 71, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "cpu_5s_percent": 99, "cpu_1m_percent": 82, "cpu_5m_percent": 71, "top_process": "IP Input"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T10:16:26.011337Z", "memory_used_percent": 87, "memory_free_mb": 352, "memory_total_mb": 2048, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 87, "memory_free_mb": 352, "memory_total_mb": 2048, "top_consumer": "crypto"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T01:34:26.014857Z", "process": "ospf", "pid": 1339, "crash_count_24h": 16, "last_crash_reason": "Watchdog timeout", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "process": "ospf", "pid": 1339, "crash_count_24h": 16, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T04:15:26.010220Z", "memory_used_percent": 88, "memory_free_mb": 331, "memory_total_mb": 4096, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 88, "memory_free_mb": 331, "memory_total_mb": 4096, "top_consumer": "cef"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T04:19:26.008933Z", "memory_used_percent": 87, "memory_free_mb": 279, "memory_total_mb": 4096, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 87, "memory_free_mb": 279, "memory_total_mb": 4096, "top_consumer": "logging"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:37:26.015672Z", "process": "bgp", "pid": 3070, "crash_count_24h": 3, "last_crash_reason": "Watchdog timeout", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "bgp", "pid": 3070, "crash_count_24h": 3, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T08:15:26.010235Z", "memory_used_percent": 97, "memory_free_mb": 248, "memory_total_mb": 1024, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "memory_used_percent": 97, "memory_free_mb": 248, "memory_total_mb": 1024, "top_consumer": "ospf"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:51:26.009951Z", "memory_used_percent": 84, "memory_free_mb": 409, "memory_total_mb": 4096, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 84, "memory_free_mb": 409, "memory_total_mb": 4096, "top_consumer": "crypto"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T10:14:26.007024Z", "cpu_5s_percent": 99, "cpu_1m_percent": 85, "cpu_5m_percent": 87, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "cpu_5s_percent": 99, "cpu_1m_percent": 85, "cpu_5m_percent": 87, "top_process": "Crypto IKEv2"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T02:17:26.008018Z", "cpu_5s_percent": 98, "cpu_1m_percent": 86, "cpu_5m_percent": 91, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 98, "cpu_1m_percent": 86, "cpu_5m_percent": 91, "top_process": "SSH Process"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T05:57:26.014051Z", "process": "snmpd", "pid": 1141, "crash_count_24h": 4, "last_crash_reason": "Watchdog timeout", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 1141, "crash_count_24h": 4, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T10:32:26.013447Z", "process": "snmpd", "pid": 4685, "crash_count_24h": 11, "last_crash_reason": "Unhandled exception", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 4685, "crash_count_24h": 11, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T06:54:26.009462Z", "memory_used_percent": 88, "memory_free_mb": 343, "memory_total_mb": 2048, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 88, "memory_free_mb": 343, "memory_total_mb": 2048, "top_consumer": "cef"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T03:09:26.004219Z", "cpu_5s_percent": 98, "cpu_1m_percent": 90, "cpu_5m_percent": 69, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 98, "cpu_1m_percent": 90, "cpu_5m_percent": 69, "top_process": "SSH Process"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T07:14:26.006183Z", "cpu_5s_percent": 99, "cpu_1m_percent": 93, "cpu_5m_percent": 68, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 99, "cpu_1m_percent": 93, "cpu_5m_percent": 68, "top_process": "OSPF-1 Router"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T06:27:26.008154Z", "cpu_5s_percent": 98, "cpu_1m_percent": 91, "cpu_5m_percent": 75, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 98, "cpu_1m_percent": 91, "cpu_5m_percent": 75, "top_process": "BGP Scanner"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T08:08:26.014584Z", "process": "iosd", "pid": 3739, "crash_count_24h": 9, "last_crash_reason": "Segmentation fault", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "process": "iosd", "pid": 3739, "crash_count_24h": 9, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:48:26.010615Z", "memory_used_percent": 93, "memory_free_mb": 139, "memory_total_mb": 8192, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 93, "memory_free_mb": 139, "memory_total_mb": 8192, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:34:26.010011Z", "memory_used_percent": 84, "memory_free_mb": 500, "memory_total_mb": 1024, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 84, "memory_free_mb": 500, "memory_total_mb": 1024, "top_consumer": "cef"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:23:26.012205Z", "memory_used_percent": 89, "memory_free_mb": 153, "memory_total_mb": 8192, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "memory_used_percent": 89, "memory_free_mb": 153, "memory_total_mb": 8192, "top_consumer": "ospf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T05:40:26.007498Z", "cpu_5s_percent": 97, "cpu_1m_percent": 94, "cpu_5m_percent": 93, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 97, "cpu_1m_percent": 94, "cpu_5m_percent": 93, "top_process": "SSH Process"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T08:03:26.007444Z", "cpu_5s_percent": 96, "cpu_1m_percent": 98, "cpu_5m_percent": 78, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 96, "cpu_1m_percent": 98, "cpu_5m_percent": 78, "top_process": "SSH Process"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T05:38:26.007978Z", "cpu_5s_percent": 100, "cpu_1m_percent": 84, "cpu_5m_percent": 70, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "cpu_5s_percent": 100, "cpu_1m_percent": 84, "cpu_5m_percent": 70, "top_process": "IP Input"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T08:03:26.006996Z", "cpu_5s_percent": 95, "cpu_1m_percent": 92, "cpu_5m_percent": 67, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 95, "cpu_1m_percent": 92, "cpu_5m_percent": 67, "top_process": "SNMP ENGINE"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T01:35:26.015156Z", "process": "crypto", "pid": 1525, "crash_count_24h": 10, "last_crash_reason": "Memory corruption", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "crypto", "pid": 1525, "crash_count_24h": 10, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T01:57:26.015743Z", "process": "bgp", "pid": 682, "crash_count_24h": 19, "last_crash_reason": "Memory corruption", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "process": "bgp", "pid": 682, "crash_count_24h": 19, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:22:26.013602Z", "process": "netconf", "pid": 4020, "crash_count_24h": 9, "last_crash_reason": "Segmentation fault", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "process": "netconf", "pid": 4020, "crash_count_24h": 9, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:56:26.010354Z", "memory_used_percent": 89, "memory_free_mb": 203, "memory_total_mb": 1024, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 89, "memory_free_mb": 203, "memory_total_mb": 1024, "top_consumer": "logging"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T02:36:26.012832Z", "process": "crypto", "pid": 3402, "crash_count_24h": 23, "last_crash_reason": "Segmentation fault", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "crypto", "pid": 3402, "crash_count_24h": 23, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T09:41:26.006436Z", "cpu_5s_percent": 99, "cpu_1m_percent": 89, "cpu_5m_percent": 95, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 99, "cpu_1m_percent": 89, "cpu_5m_percent": 95, "top_process": "OSPF-1 Router"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T07:30:26.011395Z", "memory_used_percent": 86, "memory_free_mb": 264, "memory_total_mb": 2048, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 86, "memory_free_mb": 264, "memory_total_mb": 2048, "top_consumer": "netconf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:59:26.005709Z", "cpu_5s_percent": 91, "cpu_1m_percent": 77, "cpu_5m_percent": 78, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 91, "cpu_1m_percent": 77, "cpu_5m_percent": 78, "top_process": "OSPF-1 Router"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T02:41:26.005600Z", "cpu_5s_percent": 87, "cpu_1m_percent": 98, "cpu_5m_percent": 88, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 87, "cpu_1m_percent": 98, "cpu_5m_percent": 88, "top_process": "CEF RP"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T08:17:26.006427Z", "cpu_5s_percent": 100, "cpu_1m_percent": 85, "cpu_5m_percent": 84, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "cpu_5s_percent": 100, "cpu_1m_percent": 85, "cpu_5m_percent": 84, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T10:58:26.014459Z", "process": "snmpd", "pid": 1055, "crash_count_24h": 18, "last_crash_reason": "Watchdog timeout", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 1055, "crash_count_24h": 18, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T10:11:26.011537Z", "memory_used_percent": 82, "memory_free_mb": 150, "memory_total_mb": 8192, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "memory_used_percent": 82, "memory_free_mb": 150, "memory_total_mb": 8192, "top_consumer": "netconf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T06:59:26.006670Z", "cpu_5s_percent": 93, "cpu_1m_percent": 87, "cpu_5m_percent": 74, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 93, "cpu_1m_percent": 87, "cpu_5m_percent": 74, "top_process": "CEF RP"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T06:05:26.007366Z", "cpu_5s_percent": 89, "cpu_1m_percent": 97, "cpu_5m_percent": 88, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "cpu_5s_percent": 89, "cpu_1m_percent": 97, "cpu_5m_percent": 88, "top_process": "IP Input"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T06:26:26.009106Z", "memory_used_percent": 93, "memory_free_mb": 410, "memory_total_mb": 1024, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 93, "memory_free_mb": 410, "memory_total_mb": 1024, "top_consumer": "telemetry"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T10:35:26.012823Z", "process": "iosd", "pid": 4799, "crash_count_24h": 13, "last_crash_reason": "Watchdog timeout", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 4799, "crash_count_24h": 13, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:14:26.011148Z", "memory_used_percent": 86, "memory_free_mb": 222, "memory_total_mb": 4096, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 86, "memory_free_mb": 222, "memory_total_mb": 4096, "top_consumer": "qos"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T04:12:26.010181Z", "memory_used_percent": 85, "memory_free_mb": 96, "memory_total_mb": 4096, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "memory_used_percent": 85, "memory_free_mb": 96, "memory_total_mb": 4096, "top_consumer": "netconf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T06:29:26.006977Z", "cpu_5s_percent": 94, "cpu_1m_percent": 99, "cpu_5m_percent": 78, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 94, "cpu_1m_percent": 99, "cpu_5m_percent": 78, "top_process": "OSPF-1 Router"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T07:05:26.011207Z", "memory_used_percent": 84, "memory_free_mb": 219, "memory_total_mb": 2048, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 84, "memory_free_mb": 219, "memory_total_mb": 2048, "top_consumer": "logging"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T04:40:26.005005Z", "cpu_5s_percent": 94, "cpu_1m_percent": 93, "cpu_5m_percent": 66, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 94, "cpu_1m_percent": 93, "cpu_5m_percent": 66, "top_process": "SSH Process"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T01:54:26.012979Z", "process": "snmpd", "pid": 4279, "crash_count_24h": 14, "last_crash_reason": "Segmentation fault", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "snmpd", "pid": 4279, "crash_count_24h": 14, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T04:51:26.011216Z", "memory_used_percent": 82, "memory_free_mb": 334, "memory_total_mb": 4096, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "memory_used_percent": 82, "memory_free_mb": 334, "memory_total_mb": 4096, "top_consumer": "crypto"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T02:35:26.004411Z", "cpu_5s_percent": 99, "cpu_1m_percent": 97, "cpu_5m_percent": 87, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 99, "cpu_1m_percent": 97, "cpu_5m_percent": 87, "top_process": "BGP Scanner"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T01:32:26.004721Z", "cpu_5s_percent": 88, "cpu_1m_percent": 96, "cpu_5m_percent": 82, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 88, "cpu_1m_percent": 96, "cpu_5m_percent": 82, "top_process": "BGP Scanner"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T02:02:26.014676Z", "process": "telemetry", "pid": 978, "crash_count_24h": 8, "last_crash_reason": "Memory corruption", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "telemetry", "pid": 978, "crash_count_24h": 8, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T09:16:26.005357Z", "cpu_5s_percent": 95, "cpu_1m_percent": 79, "cpu_5m_percent": 82, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 95, "cpu_1m_percent": 79, "cpu_5m_percent": 82, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T10:23:26.010649Z", "memory_used_percent": 91, "memory_free_mb": 418, "memory_total_mb": 8192, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 91, "memory_free_mb": 418, "memory_total_mb": 8192, "top_consumer": "qos"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:53:26.012150Z", "memory_used_percent": 81, "memory_free_mb": 376, "memory_total_mb": 8192, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 81, "memory_free_mb": 376, "memory_total_mb": 8192, "top_consumer": "crypto"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T03:40:26.009524Z", "memory_used_percent": 99, "memory_free_mb": 301, "memory_total_mb": 8192, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 99, "memory_free_mb": 301, "memory_total_mb": 8192, "top_consumer": "bgp"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T07:46:26.008665Z", "memory_used_percent": 90, "memory_free_mb": 443, "memory_total_mb": 1024, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 90, "memory_free_mb": 443, "memory_total_mb": 1024, "top_consumer": "netconf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T03:47:26.015114Z", "process": "crypto", "pid": 3937, "crash_count_24h": 25, "last_crash_reason": "Watchdog timeout", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "crypto", "pid": 3937, "crash_count_24h": 25, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:03:26.014341Z", "process": "crypto", "pid": 4912, "crash_count_24h": 21, "last_crash_reason": "Unhandled exception", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "process": "crypto", "pid": 4912, "crash_count_24h": 21, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T10:52:26.011365Z", "memory_used_percent": 84, "memory_free_mb": 228, "memory_total_mb": 2048, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 84, "memory_free_mb": 228, "memory_total_mb": 2048, "top_consumer": "netconf"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T02:01:26.004969Z", "cpu_5s_percent": 99, "cpu_1m_percent": 95, "cpu_5m_percent": 79, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 99, "cpu_1m_percent": 95, "cpu_5m_percent": 79, "top_process": "ARP Input"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T06:06:26.005728Z", "cpu_5s_percent": 96, "cpu_1m_percent": 97, "cpu_5m_percent": 71, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 96, "cpu_1m_percent": 97, "cpu_5m_percent": 71, "top_process": "Net Background"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T03:57:26.015430Z", "process": "iosd", "pid": 2143, "crash_count_24h": 15, "last_crash_reason": "Segmentation fault", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "iosd", "pid": 2143, "crash_count_24h": 15, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T07:08:26.007817Z", "cpu_5s_percent": 90, "cpu_1m_percent": 76, "cpu_5m_percent": 86, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 90, "cpu_1m_percent": 76, "cpu_5m_percent": 86, "top_process": "Net Background"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T11:21:26.011126Z", "memory_used_percent": 86, "memory_free_mb": 248, "memory_total_mb": 2048, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 86, "memory_free_mb": 248, "memory_total_mb": 2048, "top_consumer": "crypto"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:56:26.006871Z", "cpu_5s_percent": 85, "cpu_1m_percent": 95, "cpu_5m_percent": 91, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 85, "cpu_1m_percent": 95, "cpu_5m_percent": 91, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T04:44:26.006359Z", "cpu_5s_percent": 96, "cpu_1m_percent": 86, "cpu_5m_percent": 89, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 96, "cpu_1m_percent": 86, "cpu_5m_percent": 89, "top_process": "SSH Process"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T03:11:26.011315Z", "memory_used_percent": 97, "memory_free_mb": 91, "memory_total_mb": 4096, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 97, "memory_free_mb": 91, "memory_total_mb": 4096, "top_consumer": "netconf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T02:00:26.015651Z", "process": "ospf", "pid": 4832, "crash_count_24h": 12, "last_crash_reason": "Unhandled exception", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "ospf", "pid": 4832, "crash_count_24h": 12, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T05:36:26.009766Z", "memory_used_percent": 96, "memory_free_mb": 61, "memory_total_mb": 4096, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "memory_used_percent": 96, "memory_free_mb": 61, "memory_total_mb": 4096, "top_consumer": "telemetry"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T03:46:26.009301Z", "memory_used_percent": 99, "memory_free_mb": 55, "memory_total_mb": 1024, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 99, "memory_free_mb": 55, "memory_total_mb": 1024, "top_consumer": "netconf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T08:25:26.004575Z", "cpu_5s_percent": 97, "cpu_1m_percent": 76, "cpu_5m_percent": 71, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "cpu_5s_percent": 97, "cpu_1m_percent": 76, "cpu_5m_percent": 71, "top_process": "BGP Scanner"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T07:03:26.010957Z", "memory_used_percent": 87, "memory_free_mb": 55, "memory_total_mb": 8192, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 87, "memory_free_mb": 55, "memory_total_mb": 8192, "top_consumer": "qos"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T10:51:26.015440Z", "process": "ospf", "pid": 4728, "crash_count_24h": 19, "last_crash_reason": "Memory corruption", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "ospf", "pid": 4728, "crash_count_24h": 19, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T07:56:26.009514Z", "memory_used_percent": 95, "memory_free_mb": 312, "memory_total_mb": 8192, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 95, "memory_free_mb": 312, "memory_total_mb": 8192, "top_consumer": "bgp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:16:26.006841Z", "cpu_5s_percent": 88, "cpu_1m_percent": 81, "cpu_5m_percent": 74, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 88, "cpu_1m_percent": 81, "cpu_5m_percent": 74, "top_process": "CEF RP"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T04:52:26.017068Z", "process": "crypto", "pid": 1887, "crash_count_24h": 19, "last_crash_reason": "Unhandled exception", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "process": "crypto", "pid": 1887, "crash_count_24h": 19, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T03:13:26.017274Z", "process": "bgp", "pid": 2378, "crash_count_24h": 10, "last_crash_reason": "Watchdog timeout", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "process": "bgp", "pid": 2378, "crash_count_24h": 10, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T04:11:26.013540Z", "process": "telemetry", "pid": 2738, "crash_count_24h": 12, "last_crash_reason": "Memory corruption", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "process": "telemetry", "pid": 2738, "crash_count_24h": 12, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:14:26.005893Z", "cpu_5s_percent": 86, "cpu_1m_percent": 90, "cpu_5m_percent": 72, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 86, "cpu_1m_percent": 90, "cpu_5m_percent": 72, "top_process": "CEF RP"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T07:32:26.011247Z", "memory_used_percent": 84, "memory_free_mb": 239, "memory_total_mb": 8192, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 84, "memory_free_mb": 239, "memory_total_mb": 8192, "top_consumer": "netconf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T08:10:26.015632Z", "process": "netconf", "pid": 4541, "crash_count_24h": 11, "last_crash_reason": "Memory corruption", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "process": "netconf", "pid": 4541, "crash_count_24h": 11, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T05:27:26.006301Z", "cpu_5s_percent": 97, "cpu_1m_percent": 97, "cpu_5m_percent": 73, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 97, "cpu_1m_percent": 97, "cpu_5m_percent": 73, "top_process": "QoS Stats"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T06:25:26.015871Z", "process": "bgp", "pid": 3295, "crash_count_24h": 8, "last_crash_reason": "Memory corruption", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "process": "bgp", "pid": 3295, "crash_count_24h": 8, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:20:26.016249Z", "process": "netconf", "pid": 2451, "crash_count_24h": 8, "last_crash_reason": "Memory corruption", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "netconf", "pid": 2451, "crash_count_24h": 8, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T07:23:26.013349Z", "process": "bgp", "pid": 1034, "crash_count_24h": 7, "last_crash_reason": "Memory corruption", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "bgp", "pid": 1034, "crash_count_24h": 7, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T07:49:26.014120Z", "process": "ospf", "pid": 3038, "crash_count_24h": 7, "last_crash_reason": "Segmentation fault", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "process": "ospf", "pid": 3038, "crash_count_24h": 7, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T10:54:26.015703Z", "process": "snmpd", "pid": 2259, "crash_count_24h": 25, "last_crash_reason": "Segmentation fault", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 2259, "crash_count_24h": 25, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T07:57:26.013791Z", "process": "snmpd", "pid": 1895, "crash_count_24h": 11, "last_crash_reason": "Unhandled exception", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "snmpd", "pid": 1895, "crash_count_24h": 11, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T01:47:26.004656Z", "cpu_5s_percent": 96, "cpu_1m_percent": 80, "cpu_5m_percent": 76, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 96, "cpu_1m_percent": 80, "cpu_5m_percent": 76, "top_process": "IP Input"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T05:29:26.009379Z", "memory_used_percent": 95, "memory_free_mb": 464, "memory_total_mb": 2048, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "memory_used_percent": 95, "memory_free_mb": 464, "memory_total_mb": 2048, "top_consumer": "ospf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:38:26.010641Z", "memory_used_percent": 88, "memory_free_mb": 179, "memory_total_mb": 8192, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 88, "memory_free_mb": 179, "memory_total_mb": 8192, "top_consumer": "bgp"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T04:29:26.006282Z", "cpu_5s_percent": 91, "cpu_1m_percent": 97, "cpu_5m_percent": 74, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "cpu_5s_percent": 91, "cpu_1m_percent": 97, "cpu_5m_percent": 74, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:37:26.008095Z", "cpu_5s_percent": 88, "cpu_1m_percent": 93, "cpu_5m_percent": 87, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "cpu_5s_percent": 88, "cpu_1m_percent": 93, "cpu_5m_percent": 87, "top_process": "IP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T05:44:26.009724Z", "memory_used_percent": 97, "memory_free_mb": 370, "memory_total_mb": 4096, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 97, "memory_free_mb": 370, "memory_total_mb": 4096, "top_consumer": "snmp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:23:26.011237Z", "memory_used_percent": 92, "memory_free_mb": 164, "memory_total_mb": 8192, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 92, "memory_free_mb": 164, "memory_total_mb": 8192, "top_consumer": "crypto"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T06:45:26.010494Z", "memory_used_percent": 92, "memory_free_mb": 383, "memory_total_mb": 8192, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 92, "memory_free_mb": 383, "memory_total_mb": 8192, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T07:39:26.013228Z", "process": "netconf", "pid": 3911, "crash_count_24h": 7, "last_crash_reason": "Segmentation fault", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "process": "netconf", "pid": 3911, "crash_count_24h": 7, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:20:26.007515Z", "cpu_5s_percent": 91, "cpu_1m_percent": 98, "cpu_5m_percent": 76, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 91, "cpu_1m_percent": 98, "cpu_5m_percent": 76, "top_process": "BGP Scanner"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:26:26.007958Z", "cpu_5s_percent": 91, "cpu_1m_percent": 99, "cpu_5m_percent": 68, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "cpu_5s_percent": 91, "cpu_1m_percent": 99, "cpu_5m_percent": 68, "top_process": "QoS Stats"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:57:26.015610Z", "process": "crypto", "pid": 801, "crash_count_24h": 7, "last_crash_reason": "Watchdog timeout", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "crypto", "pid": 801, "crash_count_24h": 7, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:42:26.009827Z", "memory_used_percent": 91, "memory_free_mb": 403, "memory_total_mb": 2048, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 91, "memory_free_mb": 403, "memory_total_mb": 2048, "top_consumer": "crypto"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:37:26.008961Z", "memory_used_percent": 90, "memory_free_mb": 292, "memory_total_mb": 4096, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 90, "memory_free_mb": 292, "memory_total_mb": 4096, "top_consumer": "telemetry"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T06:58:26.012889Z", "process": "ospf", "pid": 3048, "crash_count_24h": 6, "last_crash_reason": "Unhandled exception", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "ospf", "pid": 3048, "crash_count_24h": 6, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T06:17:26.008758Z", "memory_used_percent": 91, "memory_free_mb": 404, "memory_total_mb": 2048, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 91, "memory_free_mb": 404, "memory_total_mb": 2048, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:13:26.011987Z", "memory_used_percent": 81, "memory_free_mb": 76, "memory_total_mb": 8192, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "memory_used_percent": 81, "memory_free_mb": 76, "memory_total_mb": 8192, "top_consumer": "ospf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T05:57:26.007043Z", "cpu_5s_percent": 95, "cpu_1m_percent": 93, "cpu_5m_percent": 94, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "cpu_5s_percent": 95, "cpu_1m_percent": 93, "cpu_5m_percent": 94, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T10:06:26.006770Z", "cpu_5s_percent": 96, "cpu_1m_percent": 87, "cpu_5m_percent": 95, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 96, "cpu_1m_percent": 87, "cpu_5m_percent": 95, "top_process": "BGP Scanner"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T02:29:26.008038Z", "cpu_5s_percent": 99, "cpu_1m_percent": 95, "cpu_5m_percent": 73, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 99, "cpu_1m_percent": 95, "cpu_5m_percent": 73, "top_process": "IP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:14:26.006642Z", "cpu_5s_percent": 93, "cpu_1m_percent": 90, "cpu_5m_percent": 65, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 93, "cpu_1m_percent": 90, "cpu_5m_percent": 65, "top_process": "ARP Input"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:39:26.011547Z", "memory_used_percent": 83, "memory_free_mb": 305, "memory_total_mb": 1024, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 83, "memory_free_mb": 305, "memory_total_mb": 1024, "top_consumer": "netconf"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:16:26.006398Z", "cpu_5s_percent": 88, "cpu_1m_percent": 81, "cpu_5m_percent": 77, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "cpu_5s_percent": 88, "cpu_1m_percent": 81, "cpu_5m_percent": 77, "top_process": "BGP Scanner"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T01:28:26.008824Z", "memory_used_percent": 84, "memory_free_mb": 326, "memory_total_mb": 8192, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "memory_used_percent": 84, "memory_free_mb": 326, "memory_total_mb": 8192, "top_consumer": "bgp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:59:26.008272Z", "cpu_5s_percent": 87, "cpu_1m_percent": 89, "cpu_5m_percent": 84, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 87, "cpu_1m_percent": 89, "cpu_5m_percent": 84, "top_process": "SNMP ENGINE"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T10:02:26.010900Z", "memory_used_percent": 97, "memory_free_mb": 185, "memory_total_mb": 1024, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "memory_used_percent": 97, "memory_free_mb": 185, "memory_total_mb": 1024, "top_consumer": "netconf"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T02:48:26.012293Z", "memory_used_percent": 97, "memory_free_mb": 115, "memory_total_mb": 1024, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 97, "memory_free_mb": 115, "memory_total_mb": 1024, "top_consumer": "cef"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T01:43:26.015309Z", "process": "crypto", "pid": 4628, "crash_count_24h": 7, "last_crash_reason": "Segmentation fault", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "crypto", "pid": 4628, "crash_count_24h": 7, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:42:26.007712Z", "cpu_5s_percent": 93, "cpu_1m_percent": 77, "cpu_5m_percent": 85, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 93, "cpu_1m_percent": 77, "cpu_5m_percent": 85, "top_process": "CEF RP"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T10:15:26.015239Z", "process": "iosd", "pid": 3666, "crash_count_24h": 9, "last_crash_reason": "Segmentation fault", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "process": "iosd", "pid": 3666, "crash_count_24h": 9, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T01:35:26.017217Z", "process": "snmpd", "pid": 2549, "crash_count_24h": 15, "last_crash_reason": "Segmentation fault", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "process": "snmpd", "pid": 2549, "crash_count_24h": 15, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:52:26.010315Z", "memory_used_percent": 80, "memory_free_mb": 384, "memory_total_mb": 2048, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 80, "memory_free_mb": 384, "memory_total_mb": 2048, "top_consumer": "netconf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T10:55:26.007788Z", "cpu_5s_percent": 92, "cpu_1m_percent": 89, "cpu_5m_percent": 70, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 92, "cpu_1m_percent": 89, "cpu_5m_percent": 70, "top_process": "IP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T04:58:26.012400Z", "memory_used_percent": 91, "memory_free_mb": 425, "memory_total_mb": 8192, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 91, "memory_free_mb": 425, "memory_total_mb": 8192, "top_consumer": "telemetry"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T04:22:26.016100Z", "process": "telemetry", "pid": 4800, "crash_count_24h": 18, "last_crash_reason": "Unhandled exception", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 4800, "crash_count_24h": 18, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T03:59:26.012787Z", "process": "snmpd", "pid": 2235, "crash_count_24h": 16, "last_crash_reason": "Watchdog timeout", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 2235, "crash_count_24h": 16, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T07:41:26.005137Z", "cpu_5s_percent": 87, "cpu_1m_percent": 86, "cpu_5m_percent": 74, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "cpu_5s_percent": 87, "cpu_1m_percent": 86, "cpu_5m_percent": 74, "top_process": "ARP Input"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T04:14:26.015526Z", "process": "netconf", "pid": 4706, "crash_count_24h": 5, "last_crash_reason": "Segmentation fault", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "netconf", "pid": 4706, "crash_count_24h": 5, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T04:39:26.008782Z", "memory_used_percent": 82, "memory_free_mb": 90, "memory_total_mb": 8192, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 82, "memory_free_mb": 90, "memory_total_mb": 8192, "top_consumer": "logging"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T10:47:26.005986Z", "cpu_5s_percent": 99, "cpu_1m_percent": 91, "cpu_5m_percent": 85, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 99, "cpu_1m_percent": 91, "cpu_5m_percent": 85, "top_process": "ARP Input"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T09:32:26.007552Z", "cpu_5s_percent": 95, "cpu_1m_percent": 83, "cpu_5m_percent": 71, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 95, "cpu_1m_percent": 83, "cpu_5m_percent": 71, "top_process": "BGP Scanner"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T11:01:26.014536Z", "process": "snmpd", "pid": 3145, "crash_count_24h": 7, "last_crash_reason": "Watchdog timeout", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 3145, "crash_count_24h": 7, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T08:28:26.014508Z", "process": "netconf", "pid": 2345, "crash_count_24h": 20, "last_crash_reason": "Memory corruption", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "process": "netconf", "pid": 2345, "crash_count_24h": 20, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T04:02:26.015449Z", "process": "telemetry", "pid": 872, "crash_count_24h": 9, "last_crash_reason": "Memory corruption", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 872, "crash_count_24h": 9, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T02:30:26.016401Z", "process": "bgp", "pid": 1448, "crash_count_24h": 22, "last_crash_reason": "Memory corruption", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "bgp", "pid": 1448, "crash_count_24h": 22, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T06:32:26.008904Z", "memory_used_percent": 90, "memory_free_mb": 209, "memory_total_mb": 2048, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 90, "memory_free_mb": 209, "memory_total_mb": 2048, "top_consumer": "netconf"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T11:04:26.008841Z", "memory_used_percent": 82, "memory_free_mb": 468, "memory_total_mb": 2048, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 82, "memory_free_mb": 468, "memory_total_mb": 2048, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:34:26.008124Z", "cpu_5s_percent": 86, "cpu_1m_percent": 95, "cpu_5m_percent": 84, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 86, "cpu_1m_percent": 95, "cpu_5m_percent": 84, "top_process": "SSH Process"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T07:52:26.009544Z", "memory_used_percent": 86, "memory_free_mb": 118, "memory_total_mb": 1024, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 86, "memory_free_mb": 118, "memory_total_mb": 1024, "top_consumer": "qos"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:08:26.007535Z", "cpu_5s_percent": 92, "cpu_1m_percent": 82, "cpu_5m_percent": 85, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "cpu_5s_percent": 92, "cpu_1m_percent": 82, "cpu_5m_percent": 85, "top_process": "Crypto IKEv2"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T07:42:26.015833Z", "process": "ospf", "pid": 2316, "crash_count_24h": 3, "last_crash_reason": "Segmentation fault", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "ospf", "pid": 2316, "crash_count_24h": 3, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T07:59:26.010579Z", "memory_used_percent": 98, "memory_free_mb": 265, "memory_total_mb": 8192, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 98, "memory_free_mb": 265, "memory_total_mb": 8192, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:30:26.007939Z", "cpu_5s_percent": 86, "cpu_1m_percent": 81, "cpu_5m_percent": 71, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 86, "cpu_1m_percent": 81, "cpu_5m_percent": 71, "top_process": "BGP Scanner"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T10:25:26.014351Z", "process": "crypto", "pid": 3406, "crash_count_24h": 5, "last_crash_reason": "Watchdog timeout", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "crypto", "pid": 3406, "crash_count_24h": 5, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:34:26.014647Z", "process": "telemetry", "pid": 2229, "crash_count_24h": 16, "last_crash_reason": "Segmentation fault", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 2229, "crash_count_24h": 16, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T10:43:26.012382Z", "memory_used_percent": 84, "memory_free_mb": 79, "memory_total_mb": 8192, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 84, "memory_free_mb": 79, "memory_total_mb": 8192, "top_consumer": "logging"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T10:28:26.006014Z", "cpu_5s_percent": 92, "cpu_1m_percent": 90, "cpu_5m_percent": 91, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 92, "cpu_1m_percent": 90, "cpu_5m_percent": 91, "top_process": "QoS Stats"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T04:07:26.012255Z", "memory_used_percent": 84, "memory_free_mb": 72, "memory_total_mb": 2048, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 84, "memory_free_mb": 72, "memory_total_mb": 2048, "top_consumer": "logging"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T09:34:26.005942Z", "cpu_5s_percent": 97, "cpu_1m_percent": 78, "cpu_5m_percent": 90, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 97, "cpu_1m_percent": 78, "cpu_5m_percent": 90, "top_process": "Net Background"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T06:40:26.007732Z", "cpu_5s_percent": 97, "cpu_1m_percent": 87, "cpu_5m_percent": 66, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 97, "cpu_1m_percent": 87, "cpu_5m_percent": 66, "top_process": "Net Background"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T07:44:26.009898Z", "memory_used_percent": 92, "memory_free_mb": 489, "memory_total_mb": 8192, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "memory_used_percent": 92, "memory_free_mb": 489, "memory_total_mb": 8192, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T10:25:26.016480Z", "process": "crypto", "pid": 4829, "crash_count_24h": 2, "last_crash_reason": "Memory corruption", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "crypto", "pid": 4829, "crash_count_24h": 2, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:09:26.008851Z", "memory_used_percent": 89, "memory_free_mb": 471, "memory_total_mb": 8192, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 89, "memory_free_mb": 471, "memory_total_mb": 8192, "top_consumer": "bgp"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T09:38:26.017238Z", "process": "snmpd", "pid": 2696, "crash_count_24h": 19, "last_crash_reason": "Segmentation fault", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 2696, "crash_count_24h": 19, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:16:26.012957Z", "process": "ospf", "pid": 1848, "crash_count_24h": 25, "last_crash_reason": "Memory corruption", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "process": "ospf", "pid": 1848, "crash_count_24h": 25, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T08:56:26.012090Z", "memory_used_percent": 97, "memory_free_mb": 463, "memory_total_mb": 4096, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "memory_used_percent": 97, "memory_free_mb": 463, "memory_total_mb": 4096, "top_consumer": "crypto"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:31:26.015173Z", "process": "ospf", "pid": 3209, "crash_count_24h": 23, "last_crash_reason": "Memory corruption", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "ospf", "pid": 3209, "crash_count_24h": 23, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T04:34:26.009011Z", "memory_used_percent": 82, "memory_free_mb": 252, "memory_total_mb": 4096, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 82, "memory_free_mb": 252, "memory_total_mb": 4096, "top_consumer": "crypto"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T03:35:26.010245Z", "memory_used_percent": 98, "memory_free_mb": 417, "memory_total_mb": 4096, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 98, "memory_free_mb": 417, "memory_total_mb": 4096, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T06:46:26.017291Z", "process": "telemetry", "pid": 3785, "crash_count_24h": 4, "last_crash_reason": "Watchdog timeout", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 3785, "crash_count_24h": 4, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T01:53:26.007544Z", "cpu_5s_percent": 96, "cpu_1m_percent": 76, "cpu_5m_percent": 84, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 96, "cpu_1m_percent": 76, "cpu_5m_percent": 84, "top_process": "QoS Stats"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T10:35:26.015584Z", "process": "telemetry", "pid": 2646, "crash_count_24h": 7, "last_crash_reason": "Watchdog timeout", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "process": "telemetry", "pid": 2646, "crash_count_24h": 7, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:45:26.009807Z", "memory_used_percent": 90, "memory_free_mb": 168, "memory_total_mb": 2048, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 90, "memory_free_mb": 168, "memory_total_mb": 2048, "top_consumer": "ospf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T06:42:26.007015Z", "cpu_5s_percent": 99, "cpu_1m_percent": 76, "cpu_5m_percent": 95, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 99, "cpu_1m_percent": 76, "cpu_5m_percent": 95, "top_process": "Net Background"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T08:18:26.009116Z", "memory_used_percent": 98, "memory_free_mb": 264, "memory_total_mb": 8192, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 98, "memory_free_mb": 264, "memory_total_mb": 8192, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T11:07:26.006039Z", "cpu_5s_percent": 87, "cpu_1m_percent": 82, "cpu_5m_percent": 66, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 87, "cpu_1m_percent": 82, "cpu_5m_percent": 66, "top_process": "Net Background"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T02:22:26.006214Z", "cpu_5s_percent": 87, "cpu_1m_percent": 79, "cpu_5m_percent": 65, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 87, "cpu_1m_percent": 79, "cpu_5m_percent": 65, "top_process": "BGP Scanner"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:33:26.012390Z", "memory_used_percent": 90, "memory_free_mb": 488, "memory_total_mb": 4096, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 90, "memory_free_mb": 488, "memory_total_mb": 4096, "top_consumer": "crypto"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T08:02:26.008687Z", "memory_used_percent": 95, "memory_free_mb": 88, "memory_total_mb": 4096, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 95, "memory_free_mb": 88, "memory_total_mb": 4096, "top_consumer": "crypto"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T03:46:26.008654Z", "memory_used_percent": 99, "memory_free_mb": 159, "memory_total_mb": 2048, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 99, "memory_free_mb": 159, "memory_total_mb": 2048, "top_consumer": "logging"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T11:12:26.009595Z", "memory_used_percent": 92, "memory_free_mb": 269, "memory_total_mb": 1024, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "memory_used_percent": 92, "memory_free_mb": 269, "memory_total_mb": 1024, "top_consumer": "logging"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T09:01:26.016015Z", "process": "bgp", "pid": 4031, "crash_count_24h": 13, "last_crash_reason": "Unhandled exception", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "bgp", "pid": 4031, "crash_count_24h": 13, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T06:43:26.005787Z", "cpu_5s_percent": 100, "cpu_1m_percent": 91, "cpu_5m_percent": 79, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 100, "cpu_1m_percent": 91, "cpu_5m_percent": 79, "top_process": "IP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T04:08:26.015800Z", "process": "snmpd", "pid": 1271, "crash_count_24h": 11, "last_crash_reason": "Segmentation fault", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "process": "snmpd", "pid": 1271, "crash_count_24h": 11, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T07:19:26.006163Z", "cpu_5s_percent": 85, "cpu_1m_percent": 95, "cpu_5m_percent": 73, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 85, "cpu_1m_percent": 95, "cpu_5m_percent": 73, "top_process": "BGP Scanner"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T04:27:26.012127Z", "memory_used_percent": 80, "memory_free_mb": 194, "memory_total_mb": 4096, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 80, "memory_free_mb": 194, "memory_total_mb": 4096, "top_consumer": "crypto"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:30:26.006272Z", "cpu_5s_percent": 94, "cpu_1m_percent": 85, "cpu_5m_percent": 91, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 94, "cpu_1m_percent": 85, "cpu_5m_percent": 91, "top_process": "Net Background"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:32:26.004823Z", "cpu_5s_percent": 85, "cpu_1m_percent": 92, "cpu_5m_percent": 95, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 85, "cpu_1m_percent": 92, "cpu_5m_percent": 95, "top_process": "SSH Process"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:55:26.015844Z", "process": "iosd", "pid": 1308, "crash_count_24h": 15, "last_crash_reason": "Watchdog timeout", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "process": "iosd", "pid": 1308, "crash_count_24h": 15, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:10:26.004205Z", "cpu_5s_percent": 85, "cpu_1m_percent": 93, "cpu_5m_percent": 72, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 85, "cpu_1m_percent": 93, "cpu_5m_percent": 72, "top_process": "QoS Stats"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T07:05:26.012796Z", "process": "telemetry", "pid": 329, "crash_count_24h": 14, "last_crash_reason": "Segmentation fault", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 329, "crash_count_24h": 14, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T04:13:26.010537Z", "memory_used_percent": 99, "memory_free_mb": 473, "memory_total_mb": 8192, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 99, "memory_free_mb": 473, "memory_total_mb": 8192, "top_consumer": "cef"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T07:09:26.012927Z", "process": "bgp", "pid": 2855, "crash_count_24h": 10, "last_crash_reason": "Watchdog timeout", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "bgp", "pid": 2855, "crash_count_24h": 10, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:47:26.009472Z", "memory_used_percent": 90, "memory_free_mb": 62, "memory_total_mb": 4096, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "memory_used_percent": 90, "memory_free_mb": 62, "memory_total_mb": 4096, "top_consumer": "telemetry"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:45:26.010919Z", "memory_used_percent": 91, "memory_free_mb": 173, "memory_total_mb": 1024, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 91, "memory_free_mb": 173, "memory_total_mb": 1024, "top_consumer": "ospf"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T11:02:26.004585Z", "cpu_5s_percent": 91, "cpu_1m_percent": 90, "cpu_5m_percent": 87, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 91, "cpu_1m_percent": 90, "cpu_5m_percent": 87, "top_process": "Net Background"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T02:21:26.012411Z", "memory_used_percent": 85, "memory_free_mb": 95, "memory_total_mb": 2048, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 85, "memory_free_mb": 95, "memory_total_mb": 2048, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T04:28:26.015965Z", "process": "telemetry", "pid": 603, "crash_count_24h": 15, "last_crash_reason": "Segmentation fault", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "telemetry", "pid": 603, "crash_count_24h": 15, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:44:26.009859Z", "memory_used_percent": 82, "memory_free_mb": 150, "memory_total_mb": 1024, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 82, "memory_free_mb": 150, "memory_total_mb": 1024, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T10:59:26.014963Z", "process": "iosd", "pid": 314, "crash_count_24h": 15, "last_crash_reason": "Unhandled exception", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "process": "iosd", "pid": 314, "crash_count_24h": 15, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T02:40:26.007578Z", "cpu_5s_percent": 93, "cpu_1m_percent": 78, "cpu_5m_percent": 90, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 93, "cpu_1m_percent": 78, "cpu_5m_percent": 90, "top_process": "SSH Process"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T08:40:26.005718Z", "cpu_5s_percent": 100, "cpu_1m_percent": 81, "cpu_5m_percent": 76, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "cpu_5s_percent": 100, "cpu_1m_percent": 81, "cpu_5m_percent": 76, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:00:26.015164Z", "process": "crypto", "pid": 1138, "crash_count_24h": 16, "last_crash_reason": "Memory corruption", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "process": "crypto", "pid": 1138, "crash_count_24h": 16, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T10:56:26.016500Z", "process": "snmpd", "pid": 3842, "crash_count_24h": 16, "last_crash_reason": "Memory corruption", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 3842, "crash_count_24h": 16, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T04:34:26.015341Z", "process": "snmpd", "pid": 3477, "crash_count_24h": 7, "last_crash_reason": "Memory corruption", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "snmpd", "pid": 3477, "crash_count_24h": 7, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:40:26.015349Z", "process": "telemetry", "pid": 1816, "crash_count_24h": 15, "last_crash_reason": "Memory corruption", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 1816, "crash_count_24h": 15, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T07:51:26.007141Z", "cpu_5s_percent": 86, "cpu_1m_percent": 84, "cpu_5m_percent": 65, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 86, "cpu_1m_percent": 84, "cpu_5m_percent": 65, "top_process": "IP Input"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T05:14:26.016081Z", "process": "telemetry", "pid": 4787, "crash_count_24h": 12, "last_crash_reason": "Watchdog timeout", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "process": "telemetry", "pid": 4787, "crash_count_24h": 12, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T04:27:26.010486Z", "memory_used_percent": 86, "memory_free_mb": 331, "memory_total_mb": 1024, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 86, "memory_free_mb": 331, "memory_total_mb": 1024, "top_consumer": "logging"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T04:39:26.009145Z", "memory_used_percent": 86, "memory_free_mb": 57, "memory_total_mb": 4096, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 86, "memory_free_mb": 57, "memory_total_mb": 4096, "top_consumer": "netconf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:10:26.008328Z", "cpu_5s_percent": 92, "cpu_1m_percent": 78, "cpu_5m_percent": 73, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 92, "cpu_1m_percent": 78, "cpu_5m_percent": 73, "top_process": "CEF RP"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T02:15:26.006821Z", "cpu_5s_percent": 89, "cpu_1m_percent": 94, "cpu_5m_percent": 74, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 89, "cpu_1m_percent": 94, "cpu_5m_percent": 74, "top_process": "SSH Process"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:35:26.010528Z", "memory_used_percent": 82, "memory_free_mb": 349, "memory_total_mb": 2048, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 82, "memory_free_mb": 349, "memory_total_mb": 2048, "top_consumer": "crypto"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:54:26.012322Z", "memory_used_percent": 84, "memory_free_mb": 68, "memory_total_mb": 8192, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 84, "memory_free_mb": 68, "memory_total_mb": 8192, "top_consumer": "snmp"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:12:26.007131Z", "cpu_5s_percent": 87, "cpu_1m_percent": 77, "cpu_5m_percent": 65, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 87, "cpu_1m_percent": 77, "cpu_5m_percent": 65, "top_process": "ARP Input"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T11:16:26.015545Z", "process": "crypto", "pid": 3310, "crash_count_24h": 13, "last_crash_reason": "Unhandled exception", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "process": "crypto", "pid": 3310, "crash_count_24h": 13, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T02:52:26.007279Z", "cpu_5s_percent": 95, "cpu_1m_percent": 78, "cpu_5m_percent": 77, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 95, "cpu_1m_percent": 78, "cpu_5m_percent": 77, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T04:45:26.008369Z", "cpu_5s_percent": 89, "cpu_1m_percent": 97, "cpu_5m_percent": 73, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 89, "cpu_1m_percent": 97, "cpu_5m_percent": 73, "top_process": "Net Background"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:33:26.005146Z", "cpu_5s_percent": 88, "cpu_1m_percent": 85, "cpu_5m_percent": 80, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "cpu_5s_percent": 88, "cpu_1m_percent": 85, "cpu_5m_percent": 80, "top_process": "OSPF-1 Router"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T01:40:26.015060Z", "process": "iosd", "pid": 1973, "crash_count_24h": 16, "last_crash_reason": "Watchdog timeout", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "process": "iosd", "pid": 1973, "crash_count_24h": 16, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T08:33:26.014775Z", "process": "crypto", "pid": 2603, "crash_count_24h": 21, "last_crash_reason": "Watchdog timeout", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "process": "crypto", "pid": 2603, "crash_count_24h": 21, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T07:38:26.007102Z", "cpu_5s_percent": 89, "cpu_1m_percent": 90, "cpu_5m_percent": 71, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 89, "cpu_1m_percent": 90, "cpu_5m_percent": 71, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T04:33:26.013896Z", "process": "iosd", "pid": 1429, "crash_count_24h": 7, "last_crash_reason": "Segmentation fault", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 1429, "crash_count_24h": 7, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T09:39:26.008737Z", "memory_used_percent": 98, "memory_free_mb": 97, "memory_total_mb": 2048, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 98, "memory_free_mb": 97, "memory_total_mb": 2048, "top_consumer": "cef"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T04:35:26.010335Z", "memory_used_percent": 82, "memory_free_mb": 349, "memory_total_mb": 8192, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "memory_used_percent": 82, "memory_free_mb": 349, "memory_total_mb": 8192, "top_consumer": "netconf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T04:41:26.013528Z", "process": "ospf", "pid": 2746, "crash_count_24h": 20, "last_crash_reason": "Watchdog timeout", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "ospf", "pid": 2746, "crash_count_24h": 20, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T10:37:26.010447Z", "memory_used_percent": 99, "memory_free_mb": 269, "memory_total_mb": 1024, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 99, "memory_free_mb": 269, "memory_total_mb": 1024, "top_consumer": "telemetry"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T02:03:26.010465Z", "memory_used_percent": 90, "memory_free_mb": 357, "memory_total_mb": 8192, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 90, "memory_free_mb": 357, "memory_total_mb": 8192, "top_consumer": "bgp"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T06:40:26.004960Z", "cpu_5s_percent": 96, "cpu_1m_percent": 82, "cpu_5m_percent": 82, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 96, "cpu_1m_percent": 82, "cpu_5m_percent": 82, "top_process": "CEF RP"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:36:26.016128Z", "process": "bgp", "pid": 951, "crash_count_24h": 18, "last_crash_reason": "Unhandled exception", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "bgp", "pid": 951, "crash_count_24h": 18, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:27:26.011681Z", "memory_used_percent": 85, "memory_free_mb": 291, "memory_total_mb": 8192, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 85, "memory_free_mb": 291, "memory_total_mb": 8192, "top_consumer": "cef"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:21:26.005699Z", "cpu_5s_percent": 85, "cpu_1m_percent": 76, "cpu_5m_percent": 68, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 85, "cpu_1m_percent": 76, "cpu_5m_percent": 68, "top_process": "Net Background"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T10:32:26.008114Z", "cpu_5s_percent": 89, "cpu_1m_percent": 99, "cpu_5m_percent": 67, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 89, "cpu_1m_percent": 99, "cpu_5m_percent": 67, "top_process": "SSH Process"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T10:28:26.013824Z", "process": "snmpd", "pid": 4913, "crash_count_24h": 25, "last_crash_reason": "Memory corruption", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 4913, "crash_count_24h": 25, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T02:17:26.013745Z", "process": "iosd", "pid": 628, "crash_count_24h": 3, "last_crash_reason": "Segmentation fault", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "iosd", "pid": 628, "crash_count_24h": 3, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T06:49:26.013670Z", "process": "snmpd", "pid": 3802, "crash_count_24h": 2, "last_crash_reason": "Segmentation fault", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 3802, "crash_count_24h": 2, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:36:26.005185Z", "cpu_5s_percent": 92, "cpu_1m_percent": 86, "cpu_5m_percent": 86, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 92, "cpu_1m_percent": 86, "cpu_5m_percent": 86, "top_process": "QoS Stats"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T07:24:26.012420Z", "memory_used_percent": 86, "memory_free_mb": 434, "memory_total_mb": 2048, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "memory_used_percent": 86, "memory_free_mb": 434, "memory_total_mb": 2048, "top_consumer": "logging"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:18:26.013660Z", "process": "bgp", "pid": 2240, "crash_count_24h": 22, "last_crash_reason": "Unhandled exception", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "process": "bgp", "pid": 2240, "crash_count_24h": 22, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T06:12:26.011557Z", "memory_used_percent": 82, "memory_free_mb": 183, "memory_total_mb": 4096, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 82, "memory_free_mb": 183, "memory_total_mb": 4096, "top_consumer": "qos"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T11:14:26.014666Z", "process": "iosd", "pid": 2711, "crash_count_24h": 15, "last_crash_reason": "Watchdog timeout", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "process": "iosd", "pid": 2711, "crash_count_24h": 15, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T09:42:26.006457Z", "cpu_5s_percent": 100, "cpu_1m_percent": 86, "cpu_5m_percent": 88, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 100, "cpu_1m_percent": 86, "cpu_5m_percent": 88, "top_process": "Net Background"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T04:17:26.013935Z", "process": "ospf", "pid": 1061, "crash_count_24h": 9, "last_crash_reason": "Unhandled exception", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "ospf", "pid": 1061, "crash_count_24h": 9, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T08:55:26.009776Z", "memory_used_percent": 98, "memory_free_mb": 451, "memory_total_mb": 8192, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 98, "memory_free_mb": 451, "memory_total_mb": 8192, "top_consumer": "bgp"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:25:26.012814Z", "process": "iosd", "pid": 4327, "crash_count_24h": 9, "last_crash_reason": "Memory corruption", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 4327, "crash_count_24h": 9, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:33:26.017208Z", "process": "crypto", "pid": 1226, "crash_count_24h": 9, "last_crash_reason": "Memory corruption", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "process": "crypto", "pid": 1226, "crash_count_24h": 9, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T02:50:26.008397Z", "cpu_5s_percent": 89, "cpu_1m_percent": 75, "cpu_5m_percent": 70, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 89, "cpu_1m_percent": 75, "cpu_5m_percent": 70, "top_process": "OSPF-1 Router"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T02:37:26.011481Z", "memory_used_percent": 91, "memory_free_mb": 446, "memory_total_mb": 4096, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "memory_used_percent": 91, "memory_free_mb": 446, "memory_total_mb": 4096, "top_consumer": "ospf"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T04:12:26.010389Z", "memory_used_percent": 85, "memory_free_mb": 399, "memory_total_mb": 1024, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "memory_used_percent": 85, "memory_free_mb": 399, "memory_total_mb": 1024, "top_consumer": "netconf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T01:30:26.006506Z", "cpu_5s_percent": 98, "cpu_1m_percent": 94, "cpu_5m_percent": 92, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 98, "cpu_1m_percent": 94, "cpu_5m_percent": 92, "top_process": "ARP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T02:12:26.005103Z", "cpu_5s_percent": 96, "cpu_1m_percent": 99, "cpu_5m_percent": 93, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 96, "cpu_1m_percent": 99, "cpu_5m_percent": 93, "top_process": "CEF RP"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T07:21:26.015204Z", "process": "ospf", "pid": 1853, "crash_count_24h": 13, "last_crash_reason": "Unhandled exception", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "process": "ospf", "pid": 1853, "crash_count_24h": 13, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T03:13:26.017283Z", "process": "netconf", "pid": 3328, "crash_count_24h": 21, "last_crash_reason": "Watchdog timeout", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "process": "netconf", "pid": 3328, "crash_count_24h": 21, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:13:26.015025Z", "process": "crypto", "pid": 767, "crash_count_24h": 21, "last_crash_reason": "Unhandled exception", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "process": "crypto", "pid": 767, "crash_count_24h": 21, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T03:08:26.013591Z", "process": "netconf", "pid": 3807, "crash_count_24h": 5, "last_crash_reason": "Memory corruption", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "netconf", "pid": 3807, "crash_count_24h": 5, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:20:26.010002Z", "memory_used_percent": 81, "memory_free_mb": 146, "memory_total_mb": 4096, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "memory_used_percent": 81, "memory_free_mb": 146, "memory_total_mb": 4096, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:39:26.006291Z", "cpu_5s_percent": 92, "cpu_1m_percent": 87, "cpu_5m_percent": 69, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 92, "cpu_1m_percent": 87, "cpu_5m_percent": 69, "top_process": "BGP Scanner"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T02:52:26.007179Z", "cpu_5s_percent": 85, "cpu_1m_percent": 85, "cpu_5m_percent": 90, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 85, "cpu_1m_percent": 85, "cpu_5m_percent": 90, "top_process": "Net Background"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T02:17:26.007630Z", "cpu_5s_percent": 97, "cpu_1m_percent": 81, "cpu_5m_percent": 80, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "cpu_5s_percent": 97, "cpu_1m_percent": 81, "cpu_5m_percent": 80, "top_process": "QoS Stats"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T10:29:26.010158Z", "memory_used_percent": 92, "memory_free_mb": 369, "memory_total_mb": 2048, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "memory_used_percent": 92, "memory_free_mb": 369, "memory_total_mb": 2048, "top_consumer": "snmp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:13:26.009413Z", "memory_used_percent": 83, "memory_free_mb": 341, "memory_total_mb": 8192, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 83, "memory_free_mb": 341, "memory_total_mb": 8192, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T05:29:26.013721Z", "process": "snmpd", "pid": 4977, "crash_count_24h": 22, "last_crash_reason": "Unhandled exception", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "snmpd", "pid": 4977, "crash_count_24h": 22, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T06:31:26.010325Z", "memory_used_percent": 90, "memory_free_mb": 300, "memory_total_mb": 4096, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "memory_used_percent": 90, "memory_free_mb": 300, "memory_total_mb": 4096, "top_consumer": "netconf"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T06:47:26.005758Z", "cpu_5s_percent": 89, "cpu_1m_percent": 95, "cpu_5m_percent": 93, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 89, "cpu_1m_percent": 95, "cpu_5m_percent": 93, "top_process": "QoS Stats"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T06:17:26.017143Z", "process": "crypto", "pid": 3735, "crash_count_24h": 9, "last_crash_reason": "Watchdog timeout", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "process": "crypto", "pid": 3735, "crash_count_24h": 9, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T03:17:26.007526Z", "cpu_5s_percent": 100, "cpu_1m_percent": 77, "cpu_5m_percent": 88, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 100, "cpu_1m_percent": 77, "cpu_5m_percent": 88, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:09:26.007596Z", "cpu_5s_percent": 89, "cpu_1m_percent": 98, "cpu_5m_percent": 68, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "cpu_5s_percent": 89, "cpu_1m_percent": 98, "cpu_5m_percent": 68, "top_process": "ARP Input"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:18:26.004533Z", "cpu_5s_percent": 94, "cpu_1m_percent": 89, "cpu_5m_percent": 75, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 94, "cpu_1m_percent": 89, "cpu_5m_percent": 75, "top_process": "ARP Input"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T08:07:26.013781Z", "process": "iosd", "pid": 3024, "crash_count_24h": 13, "last_crash_reason": "Unhandled exception", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "process": "iosd", "pid": 3024, "crash_count_24h": 13, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T02:23:26.004635Z", "cpu_5s_percent": 100, "cpu_1m_percent": 89, "cpu_5m_percent": 68, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 100, "cpu_1m_percent": 89, "cpu_5m_percent": 68, "top_process": "ARP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T09:35:26.007121Z", "cpu_5s_percent": 97, "cpu_1m_percent": 77, "cpu_5m_percent": 93, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 97, "cpu_1m_percent": 77, "cpu_5m_percent": 93, "top_process": "CEF RP"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:12:26.005670Z", "cpu_5s_percent": 90, "cpu_1m_percent": 97, "cpu_5m_percent": 66, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 90, "cpu_1m_percent": 97, "cpu_5m_percent": 66, "top_process": "OSPF-1 Router"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T04:19:26.006330Z", "cpu_5s_percent": 95, "cpu_1m_percent": 92, "cpu_5m_percent": 74, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 95, "cpu_1m_percent": 92, "cpu_5m_percent": 74, "top_process": "IP Input"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:27:26.009504Z", "memory_used_percent": 82, "memory_free_mb": 58, "memory_total_mb": 4096, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "memory_used_percent": 82, "memory_free_mb": 58, "memory_total_mb": 4096, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:32:26.010938Z", "memory_used_percent": 87, "memory_free_mb": 158, "memory_total_mb": 1024, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "memory_used_percent": 87, "memory_free_mb": 158, "memory_total_mb": 1024, "top_consumer": "snmp"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T01:46:26.004667Z", "cpu_5s_percent": 91, "cpu_1m_percent": 93, "cpu_5m_percent": 74, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 91, "cpu_1m_percent": 93, "cpu_5m_percent": 74, "top_process": "QoS Stats"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T07:53:26.011257Z", "memory_used_percent": 93, "memory_free_mb": 144, "memory_total_mb": 1024, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 93, "memory_free_mb": 144, "memory_total_mb": 1024, "top_consumer": "crypto"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:59:26.005914Z", "cpu_5s_percent": 86, "cpu_1m_percent": 91, "cpu_5m_percent": 79, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 86, "cpu_1m_percent": 91, "cpu_5m_percent": 79, "top_process": "CEF RP"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T04:17:26.010080Z", "memory_used_percent": 81, "memory_free_mb": 444, "memory_total_mb": 2048, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 81, "memory_free_mb": 444, "memory_total_mb": 2048, "top_consumer": "netconf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:23:26.011327Z", "memory_used_percent": 82, "memory_free_mb": 472, "memory_total_mb": 1024, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "memory_used_percent": 82, "memory_free_mb": 472, "memory_total_mb": 1024, "top_consumer": "telemetry"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:58:26.009664Z", "memory_used_percent": 88, "memory_free_mb": 176, "memory_total_mb": 1024, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "memory_used_percent": 88, "memory_free_mb": 176, "memory_total_mb": 1024, "top_consumer": "telemetry"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:37:26.009991Z", "memory_used_percent": 89, "memory_free_mb": 426, "memory_total_mb": 2048, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 89, "memory_free_mb": 426, "memory_total_mb": 2048, "top_consumer": "cef"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T10:32:26.010890Z", "memory_used_percent": 87, "memory_free_mb": 248, "memory_total_mb": 4096, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 87, "memory_free_mb": 248, "memory_total_mb": 4096, "top_consumer": "ospf"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:17:26.008201Z", "cpu_5s_percent": 89, "cpu_1m_percent": 99, "cpu_5m_percent": 75, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 89, "cpu_1m_percent": 99, "cpu_5m_percent": 75, "top_process": "CEF RP"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T03:23:26.005884Z", "cpu_5s_percent": 95, "cpu_1m_percent": 97, "cpu_5m_percent": 93, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 95, "cpu_1m_percent": 97, "cpu_5m_percent": 93, "top_process": "SNMP ENGINE"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T02:37:26.010141Z", "memory_used_percent": 86, "memory_free_mb": 359, "memory_total_mb": 4096, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 86, "memory_free_mb": 359, "memory_total_mb": 4096, "top_consumer": "qos"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T02:04:26.014235Z", "process": "telemetry", "pid": 1219, "crash_count_24h": 3, "last_crash_reason": "Unhandled exception", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 1219, "crash_count_24h": 3, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:16:26.014071Z", "process": "crypto", "pid": 2349, "crash_count_24h": 20, "last_crash_reason": "Memory corruption", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "crypto", "pid": 2349, "crash_count_24h": 20, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:33:26.010658Z", "memory_used_percent": 85, "memory_free_mb": 97, "memory_total_mb": 4096, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 85, "memory_free_mb": 97, "memory_total_mb": 4096, "top_consumer": "snmp"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T10:55:26.014188Z", "process": "telemetry", "pid": 4374, "crash_count_24h": 6, "last_crash_reason": "Unhandled exception", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "telemetry", "pid": 4374, "crash_count_24h": 6, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T10:37:26.004441Z", "cpu_5s_percent": 91, "cpu_1m_percent": 82, "cpu_5m_percent": 68, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 91, "cpu_1m_percent": 82, "cpu_5m_percent": 68, "top_process": "SSH Process"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:17:26.016137Z", "process": "telemetry", "pid": 1819, "crash_count_24h": 6, "last_crash_reason": "Unhandled exception", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "telemetry", "pid": 1819, "crash_count_24h": 6, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T06:57:26.010438Z", "memory_used_percent": 97, "memory_free_mb": 434, "memory_total_mb": 8192, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 97, "memory_free_mb": 434, "memory_total_mb": 8192, "top_consumer": "cef"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:45:26.016582Z", "process": "snmpd", "pid": 4138, "crash_count_24h": 4, "last_crash_reason": "Watchdog timeout", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 4138, "crash_count_24h": 4, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T04:07:26.015182Z", "process": "crypto", "pid": 2246, "crash_count_24h": 15, "last_crash_reason": "Unhandled exception", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "crypto", "pid": 2246, "crash_count_24h": 15, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T06:29:26.007779Z", "cpu_5s_percent": 97, "cpu_1m_percent": 84, "cpu_5m_percent": 73, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "cpu_5s_percent": 97, "cpu_1m_percent": 84, "cpu_5m_percent": 73, "top_process": "SSH Process"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:50:26.016470Z", "process": "bgp", "pid": 2535, "crash_count_24h": 11, "last_crash_reason": "Memory corruption", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "bgp", "pid": 2535, "crash_count_24h": 11, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:02:26.016564Z", "process": "bgp", "pid": 507, "crash_count_24h": 8, "last_crash_reason": "Watchdog timeout", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "bgp", "pid": 507, "crash_count_24h": 8, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:07:26.007770Z", "cpu_5s_percent": 90, "cpu_1m_percent": 87, "cpu_5m_percent": 82, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 90, "cpu_1m_percent": 87, "cpu_5m_percent": 82, "top_process": "SSH Process"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T04:11:26.008086Z", "cpu_5s_percent": 95, "cpu_1m_percent": 95, "cpu_5m_percent": 89, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 95, "cpu_1m_percent": 95, "cpu_5m_percent": 89, "top_process": "SSH Process"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:24:26.008359Z", "cpu_5s_percent": 86, "cpu_1m_percent": 98, "cpu_5m_percent": 79, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 86, "cpu_1m_percent": 98, "cpu_5m_percent": 79, "top_process": "BGP Scanner"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:46:26.016457Z", "process": "crypto", "pid": 2123, "crash_count_24h": 2, "last_crash_reason": "Segmentation fault", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "process": "crypto", "pid": 2123, "crash_count_24h": 2, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:09:26.006100Z", "cpu_5s_percent": 87, "cpu_1m_percent": 98, "cpu_5m_percent": 89, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "cpu_5s_percent": 87, "cpu_1m_percent": 98, "cpu_5m_percent": 89, "top_process": "ARP Input"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T05:33:26.013466Z", "process": "ospf", "pid": 1446, "crash_count_24h": 5, "last_crash_reason": "Memory corruption", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "ospf", "pid": 1446, "crash_count_24h": 5, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T10:53:26.008076Z", "cpu_5s_percent": 86, "cpu_1m_percent": 83, "cpu_5m_percent": 89, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 86, "cpu_1m_percent": 83, "cpu_5m_percent": 89, "top_process": "CEF RP"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T09:48:26.010729Z", "memory_used_percent": 98, "memory_free_mb": 189, "memory_total_mb": 2048, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 98, "memory_free_mb": 189, "memory_total_mb": 2048, "top_consumer": "logging"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T11:22:26.008882Z", "memory_used_percent": 96, "memory_free_mb": 461, "memory_total_mb": 4096, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 96, "memory_free_mb": 461, "memory_total_mb": 4096, "top_consumer": "telemetry"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T08:28:26.007355Z", "cpu_5s_percent": 97, "cpu_1m_percent": 79, "cpu_5m_percent": 81, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 97, "cpu_1m_percent": 79, "cpu_5m_percent": 81, "top_process": "CEF RP"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T01:59:26.012709Z", "process": "bgp", "pid": 2440, "crash_count_24h": 20, "last_crash_reason": "Watchdog timeout", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "process": "bgp", "pid": 2440, "crash_count_24h": 20, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T10:13:26.015565Z", "process": "telemetry", "pid": 3563, "crash_count_24h": 11, "last_crash_reason": "Memory corruption", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "process": "telemetry", "pid": 3563, "crash_count_24h": 11, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:29:26.005951Z", "cpu_5s_percent": 91, "cpu_1m_percent": 76, "cpu_5m_percent": 73, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 91, "cpu_1m_percent": 76, "cpu_5m_percent": 73, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T07:42:26.006379Z", "cpu_5s_percent": 85, "cpu_1m_percent": 78, "cpu_5m_percent": 72, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 85, "cpu_1m_percent": 78, "cpu_5m_percent": 72, "top_process": "ARP Input"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T04:09:26.009878Z", "memory_used_percent": 81, "memory_free_mb": 373, "memory_total_mb": 1024, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 81, "memory_free_mb": 373, "memory_total_mb": 1024, "top_consumer": "cef"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T06:20:26.006245Z", "cpu_5s_percent": 85, "cpu_1m_percent": 89, "cpu_5m_percent": 84, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 85, "cpu_1m_percent": 89, "cpu_5m_percent": 84, "top_process": "Crypto IKEv2"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T08:26:26.004987Z", "cpu_5s_percent": 98, "cpu_1m_percent": 76, "cpu_5m_percent": 85, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 98, "cpu_1m_percent": 76, "cpu_5m_percent": 85, "top_process": "QoS Stats"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T01:28:26.012968Z", "process": "snmpd", "pid": 3250, "crash_count_24h": 22, "last_crash_reason": "Memory corruption", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 3250, "crash_count_24h": 22, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T10:56:26.010293Z", "memory_used_percent": 99, "memory_free_mb": 294, "memory_total_mb": 1024, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "memory_used_percent": 99, "memory_free_mb": 294, "memory_total_mb": 1024, "top_consumer": "snmp"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T03:39:26.008676Z", "memory_used_percent": 98, "memory_free_mb": 156, "memory_total_mb": 8192, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "memory_used_percent": 98, "memory_free_mb": 156, "memory_total_mb": 8192, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T06:00:26.014695Z", "process": "snmpd", "pid": 3552, "crash_count_24h": 22, "last_crash_reason": "Watchdog timeout", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "snmpd", "pid": 3552, "crash_count_24h": 22, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:18:26.006936Z", "cpu_5s_percent": 86, "cpu_1m_percent": 90, "cpu_5m_percent": 69, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 86, "cpu_1m_percent": 90, "cpu_5m_percent": 69, "top_process": "SSH Process"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:53:26.013925Z", "process": "bgp", "pid": 990, "crash_count_24h": 15, "last_crash_reason": "Unhandled exception", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "bgp", "pid": 990, "crash_count_24h": 15, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:07:26.012273Z", "memory_used_percent": 91, "memory_free_mb": 248, "memory_total_mb": 2048, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 91, "memory_free_mb": 248, "memory_total_mb": 2048, "top_consumer": "cef"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T07:39:26.016345Z", "process": "netconf", "pid": 3048, "crash_count_24h": 15, "last_crash_reason": "Unhandled exception", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "netconf", "pid": 3048, "crash_count_24h": 15, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:24:26.010667Z", "memory_used_percent": 80, "memory_free_mb": 425, "memory_total_mb": 1024, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 80, "memory_free_mb": 425, "memory_total_mb": 1024, "top_consumer": "logging"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:11:26.007063Z", "cpu_5s_percent": 87, "cpu_1m_percent": 99, "cpu_5m_percent": 82, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 87, "cpu_1m_percent": 99, "cpu_5m_percent": 82, "top_process": "QoS Stats"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:12:26.011748Z", "memory_used_percent": 87, "memory_free_mb": 208, "memory_total_mb": 2048, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 87, "memory_free_mb": 208, "memory_total_mb": 2048, "top_consumer": "snmp"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T07:08:26.009565Z", "memory_used_percent": 85, "memory_free_mb": 68, "memory_total_mb": 4096, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 85, "memory_free_mb": 68, "memory_total_mb": 4096, "top_consumer": "bgp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:32:26.006691Z", "cpu_5s_percent": 86, "cpu_1m_percent": 84, "cpu_5m_percent": 69, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 86, "cpu_1m_percent": 84, "cpu_5m_percent": 69, "top_process": "BGP Scanner"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T09:44:26.004711Z", "cpu_5s_percent": 98, "cpu_1m_percent": 75, "cpu_5m_percent": 66, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 98, "cpu_1m_percent": 75, "cpu_5m_percent": 66, "top_process": "Crypto IKEv2"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T10:47:26.007996Z", "cpu_5s_percent": 89, "cpu_1m_percent": 88, "cpu_5m_percent": 92, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 89, "cpu_1m_percent": 88, "cpu_5m_percent": 92, "top_process": "ARP Input"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T10:18:26.006448Z", "cpu_5s_percent": 99, "cpu_1m_percent": 88, "cpu_5m_percent": 93, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "cpu_5s_percent": 99, "cpu_1m_percent": 88, "cpu_5m_percent": 93, "top_process": "IP Input"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T10:41:26.010457Z", "memory_used_percent": 99, "memory_free_mb": 300, "memory_total_mb": 4096, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "memory_used_percent": 99, "memory_free_mb": 300, "memory_total_mb": 4096, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T06:27:26.012722Z", "process": "crypto", "pid": 3654, "crash_count_24h": 16, "last_crash_reason": "Unhandled exception", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "crypto", "pid": 3654, "crash_count_24h": 16, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:45:26.016392Z", "process": "snmpd", "pid": 2426, "crash_count_24h": 14, "last_crash_reason": "Memory corruption", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "snmpd", "pid": 2426, "crash_count_24h": 14, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T10:16:26.017115Z", "process": "snmpd", "pid": 3923, "crash_count_24h": 7, "last_crash_reason": "Watchdog timeout", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 3923, "crash_count_24h": 7, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T05:33:26.015861Z", "process": "crypto", "pid": 1446, "crash_count_24h": 21, "last_crash_reason": "Unhandled exception", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "crypto", "pid": 1446, "crash_count_24h": 21, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T02:55:26.012264Z", "memory_used_percent": 86, "memory_free_mb": 396, "memory_total_mb": 4096, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 86, "memory_free_mb": 396, "memory_total_mb": 4096, "top_consumer": "snmp"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T10:53:26.014526Z", "process": "ospf", "pid": 1622, "crash_count_24h": 15, "last_crash_reason": "Watchdog timeout", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "ospf", "pid": 1622, "crash_count_24h": 15, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T07:32:26.009817Z", "memory_used_percent": 83, "memory_free_mb": 60, "memory_total_mb": 8192, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 83, "memory_free_mb": 60, "memory_total_mb": 8192, "top_consumer": "bgp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T02:09:26.011714Z", "memory_used_percent": 93, "memory_free_mb": 356, "memory_total_mb": 4096, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "memory_used_percent": 93, "memory_free_mb": 356, "memory_total_mb": 4096, "top_consumer": "snmp"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:54:26.015499Z", "process": "telemetry", "pid": 2276, "crash_count_24h": 14, "last_crash_reason": "Memory corruption", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 2276, "crash_count_24h": 14, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T07:04:26.005426Z", "cpu_5s_percent": 93, "cpu_1m_percent": 92, "cpu_5m_percent": 87, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 93, "cpu_1m_percent": 92, "cpu_5m_percent": 87, "top_process": "IP Input"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T10:32:26.006679Z", "cpu_5s_percent": 87, "cpu_1m_percent": 82, "cpu_5m_percent": 70, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 87, "cpu_1m_percent": 82, "cpu_5m_percent": 70, "top_process": "IP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T01:53:26.004074Z", "cpu_5s_percent": 88, "cpu_1m_percent": 82, "cpu_5m_percent": 93, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 88, "cpu_1m_percent": 82, "cpu_5m_percent": 93, "top_process": "QoS Stats"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T03:29:26.006750Z", "cpu_5s_percent": 98, "cpu_1m_percent": 81, "cpu_5m_percent": 73, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 98, "cpu_1m_percent": 81, "cpu_5m_percent": 73, "top_process": "OSPF-1 Router"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T07:23:26.016039Z", "process": "netconf", "pid": 2719, "crash_count_24h": 4, "last_crash_reason": "Memory corruption", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "netconf", "pid": 2719, "crash_count_24h": 4, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T02:47:26.007112Z", "cpu_5s_percent": 86, "cpu_1m_percent": 84, "cpu_5m_percent": 81, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 86, "cpu_1m_percent": 84, "cpu_5m_percent": 81, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T11:21:26.014827Z", "process": "snmpd", "pid": 4016, "crash_count_24h": 14, "last_crash_reason": "Watchdog timeout", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 4016, "crash_count_24h": 14, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T09:51:26.014934Z", "process": "netconf", "pid": 3702, "crash_count_24h": 6, "last_crash_reason": "Watchdog timeout", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "netconf", "pid": 3702, "crash_count_24h": 6, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T09:18:26.006957Z", "cpu_5s_percent": 99, "cpu_1m_percent": 96, "cpu_5m_percent": 65, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 99, "cpu_1m_percent": 96, "cpu_5m_percent": 65, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T08:35:26.005128Z", "cpu_5s_percent": 95, "cpu_1m_percent": 92, "cpu_5m_percent": 69, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 95, "cpu_1m_percent": 92, "cpu_5m_percent": 69, "top_process": "OSPF-1 Router"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T01:37:26.011651Z", "memory_used_percent": 91, "memory_free_mb": 111, "memory_total_mb": 4096, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 91, "memory_free_mb": 111, "memory_total_mb": 4096, "top_consumer": "snmp"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:36:26.012234Z", "memory_used_percent": 84, "memory_free_mb": 179, "memory_total_mb": 8192, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 84, "memory_free_mb": 179, "memory_total_mb": 8192, "top_consumer": "telemetry"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T09:50:26.016336Z", "process": "netconf", "pid": 1882, "crash_count_24h": 8, "last_crash_reason": "Memory corruption", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "process": "netconf", "pid": 1882, "crash_count_24h": 8, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T06:58:26.015781Z", "process": "iosd", "pid": 1587, "crash_count_24h": 22, "last_crash_reason": "Segmentation fault", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "process": "iosd", "pid": 1587, "crash_count_24h": 22, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T09:40:26.014302Z", "process": "bgp", "pid": 4103, "crash_count_24h": 21, "last_crash_reason": "Memory corruption", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "bgp", "pid": 4103, "crash_count_24h": 21, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:37:26.004645Z", "cpu_5s_percent": 85, "cpu_1m_percent": 77, "cpu_5m_percent": 93, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "cpu_5s_percent": 85, "cpu_1m_percent": 77, "cpu_5m_percent": 93, "top_process": "SNMP ENGINE"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T01:41:26.011899Z", "memory_used_percent": 92, "memory_free_mb": 361, "memory_total_mb": 1024, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 92, "memory_free_mb": 361, "memory_total_mb": 1024, "top_consumer": "snmp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T03:37:26.013017Z", "process": "bgp", "pid": 3313, "crash_count_24h": 24, "last_crash_reason": "Memory corruption", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "bgp", "pid": 3313, "crash_count_24h": 24, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:15:26.009031Z", "memory_used_percent": 85, "memory_free_mb": 350, "memory_total_mb": 1024, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "memory_used_percent": 85, "memory_free_mb": 350, "memory_total_mb": 1024, "top_consumer": "crypto"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:39:26.004996Z", "cpu_5s_percent": 93, "cpu_1m_percent": 79, "cpu_5m_percent": 87, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 93, "cpu_1m_percent": 79, "cpu_5m_percent": 87, "top_process": "QoS Stats"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T04:40:26.011427Z", "memory_used_percent": 81, "memory_free_mb": 336, "memory_total_mb": 4096, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 81, "memory_free_mb": 336, "memory_total_mb": 4096, "top_consumer": "crypto"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T06:07:26.004247Z", "cpu_5s_percent": 93, "cpu_1m_percent": 92, "cpu_5m_percent": 77, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 93, "cpu_1m_percent": 92, "cpu_5m_percent": 77, "top_process": "Net Background"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T10:04:26.010100Z", "memory_used_percent": 95, "memory_free_mb": 324, "memory_total_mb": 4096, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 95, "memory_free_mb": 324, "memory_total_mb": 4096, "top_consumer": "crypto"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T04:57:26.011058Z", "memory_used_percent": 94, "memory_free_mb": 386, "memory_total_mb": 4096, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "memory_used_percent": 94, "memory_free_mb": 386, "memory_total_mb": 4096, "top_consumer": "snmp"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T02:23:26.014499Z", "process": "snmpd", "pid": 3001, "crash_count_24h": 21, "last_crash_reason": "Segmentation fault", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 3001, "crash_count_24h": 21, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:17:26.015902Z", "process": "netconf", "pid": 4745, "crash_count_24h": 11, "last_crash_reason": "Watchdog timeout", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "process": "netconf", "pid": 4745, "crash_count_24h": 11, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T02:55:26.016109Z", "process": "snmpd", "pid": 4876, "crash_count_24h": 16, "last_crash_reason": "Watchdog timeout", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "process": "snmpd", "pid": 4876, "crash_count_24h": 16, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T02:42:26.015301Z", "process": "ospf", "pid": 2288, "crash_count_24h": 9, "last_crash_reason": "Unhandled exception", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "process": "ospf", "pid": 2288, "crash_count_24h": 9, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T01:33:26.006881Z", "cpu_5s_percent": 92, "cpu_1m_percent": 76, "cpu_5m_percent": 76, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 92, "cpu_1m_percent": 76, "cpu_5m_percent": 76, "top_process": "ARP Input"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T01:55:26.011605Z", "memory_used_percent": 97, "memory_free_mb": 174, "memory_total_mb": 8192, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 97, "memory_free_mb": 174, "memory_total_mb": 8192, "top_consumer": "netconf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T03:55:26.015276Z", "process": "bgp", "pid": 4895, "crash_count_24h": 9, "last_crash_reason": "Memory corruption", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "bgp", "pid": 4895, "crash_count_24h": 9, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:14:26.007667Z", "cpu_5s_percent": 94, "cpu_1m_percent": 97, "cpu_5m_percent": 65, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 94, "cpu_1m_percent": 97, "cpu_5m_percent": 65, "top_process": "IP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:58:26.004166Z", "cpu_5s_percent": 94, "cpu_1m_percent": 84, "cpu_5m_percent": 79, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 94, "cpu_1m_percent": 84, "cpu_5m_percent": 79, "top_process": "QoS Stats"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T10:15:26.014847Z", "process": "ospf", "pid": 633, "crash_count_24h": 16, "last_crash_reason": "Memory corruption", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "ospf", "pid": 633, "crash_count_24h": 16, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T08:53:26.013457Z", "process": "snmpd", "pid": 4269, "crash_count_24h": 15, "last_crash_reason": "Watchdog timeout", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 4269, "crash_count_24h": 15, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T02:33:26.008536Z", "memory_used_percent": 97, "memory_free_mb": 82, "memory_total_mb": 8192, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 97, "memory_free_mb": 82, "memory_total_mb": 8192, "top_consumer": "ospf"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T04:18:26.015922Z", "process": "netconf", "pid": 4073, "crash_count_24h": 16, "last_crash_reason": "Watchdog timeout", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "netconf", "pid": 4073, "crash_count_24h": 16, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T10:57:26.015249Z", "process": "netconf", "pid": 1515, "crash_count_24h": 20, "last_crash_reason": "Segmentation fault", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "process": "netconf", "pid": 1515, "crash_count_24h": 20, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T08:29:26.017225Z", "process": "telemetry", "pid": 1444, "crash_count_24h": 16, "last_crash_reason": "Unhandled exception", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "process": "telemetry", "pid": 1444, "crash_count_24h": 16, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:06:26.006986Z", "cpu_5s_percent": 87, "cpu_1m_percent": 87, "cpu_5m_percent": 77, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 87, "cpu_1m_percent": 87, "cpu_5m_percent": 77, "top_process": "SNMP ENGINE"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T03:45:26.009972Z", "memory_used_percent": 98, "memory_free_mb": 162, "memory_total_mb": 4096, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 98, "memory_free_mb": 162, "memory_total_mb": 4096, "top_consumer": "logging"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:02:26.006311Z", "cpu_5s_percent": 94, "cpu_1m_percent": 76, "cpu_5m_percent": 88, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 94, "cpu_1m_percent": 76, "cpu_5m_percent": 88, "top_process": "QoS Stats"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T05:35:26.005611Z", "cpu_5s_percent": 95, "cpu_1m_percent": 90, "cpu_5m_percent": 75, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 95, "cpu_1m_percent": 90, "cpu_5m_percent": 75, "top_process": "QoS Stats"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:55:26.013570Z", "process": "iosd", "pid": 879, "crash_count_24h": 3, "last_crash_reason": "Memory corruption", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 879, "crash_count_24h": 3, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T02:38:26.009241Z", "memory_used_percent": 93, "memory_free_mb": 189, "memory_total_mb": 1024, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 93, "memory_free_mb": 189, "memory_total_mb": 1024, "top_consumer": "qos"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:19:26.011948Z", "memory_used_percent": 91, "memory_free_mb": 480, "memory_total_mb": 8192, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 91, "memory_free_mb": 480, "memory_total_mb": 8192, "top_consumer": "snmp"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T01:24:26.013982Z", "process": "bgp", "pid": 1617, "crash_count_24h": 12, "last_crash_reason": "Unhandled exception", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "bgp", "pid": 1617, "crash_count_24h": 12, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:08:26.006389Z", "cpu_5s_percent": 90, "cpu_1m_percent": 88, "cpu_5m_percent": 81, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 90, "cpu_1m_percent": 88, "cpu_5m_percent": 81, "top_process": "Net Background"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T02:54:26.013814Z", "process": "iosd", "pid": 1579, "crash_count_24h": 20, "last_crash_reason": "Unhandled exception", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "iosd", "pid": 1579, "crash_count_24h": 20, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T06:51:26.006568Z", "cpu_5s_percent": 96, "cpu_1m_percent": 91, "cpu_5m_percent": 74, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 96, "cpu_1m_percent": 91, "cpu_5m_percent": 74, "top_process": "OSPF-1 Router"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T01:42:26.015555Z", "process": "bgp", "pid": 914, "crash_count_24h": 8, "last_crash_reason": "Watchdog timeout", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "bgp", "pid": 914, "crash_count_24h": 8, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T02:57:26.005236Z", "cpu_5s_percent": 95, "cpu_1m_percent": 85, "cpu_5m_percent": 94, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 95, "cpu_1m_percent": 85, "cpu_5m_percent": 94, "top_process": "CEF RP"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:40:26.015574Z", "process": "iosd", "pid": 4345, "crash_count_24h": 24, "last_crash_reason": "Unhandled exception", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 4345, "crash_count_24h": 24, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T11:09:26.008604Z", "memory_used_percent": 81, "memory_free_mb": 470, "memory_total_mb": 2048, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 81, "memory_free_mb": 470, "memory_total_mb": 2048, "top_consumer": "logging"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:14:26.009156Z", "memory_used_percent": 86, "memory_free_mb": 100, "memory_total_mb": 8192, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 86, "memory_free_mb": 100, "memory_total_mb": 8192, "top_consumer": "cef"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T10:23:26.015931Z", "process": "crypto", "pid": 1803, "crash_count_24h": 13, "last_crash_reason": "Unhandled exception", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "process": "crypto", "pid": 1803, "crash_count_24h": 13, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:23:26.013690Z", "process": "ospf", "pid": 817, "crash_count_24h": 21, "last_crash_reason": "Unhandled exception", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "ospf", "pid": 817, "crash_count_24h": 21, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T06:36:26.014866Z", "process": "iosd", "pid": 1009, "crash_count_24h": 5, "last_crash_reason": "Unhandled exception", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "process": "iosd", "pid": 1009, "crash_count_24h": 5, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:08:26.005048Z", "cpu_5s_percent": 86, "cpu_1m_percent": 98, "cpu_5m_percent": 83, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 86, "cpu_1m_percent": 98, "cpu_5m_percent": 83, "top_process": "Crypto IKEv2"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T08:22:26.010429Z", "memory_used_percent": 96, "memory_free_mb": 242, "memory_total_mb": 4096, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 96, "memory_free_mb": 242, "memory_total_mb": 4096, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T04:15:26.014423Z", "process": "netconf", "pid": 4535, "crash_count_24h": 7, "last_crash_reason": "Unhandled exception", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "netconf", "pid": 4535, "crash_count_24h": 7, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T04:44:26.005022Z", "cpu_5s_percent": 88, "cpu_1m_percent": 77, "cpu_5m_percent": 69, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 88, "cpu_1m_percent": 77, "cpu_5m_percent": 69, "top_process": "QoS Stats"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T10:57:26.009744Z", "memory_used_percent": 83, "memory_free_mb": 352, "memory_total_mb": 1024, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 83, "memory_free_mb": 352, "memory_total_mb": 1024, "top_consumer": "crypto"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T02:52:26.011834Z", "memory_used_percent": 82, "memory_free_mb": 316, "memory_total_mb": 8192, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 82, "memory_free_mb": 316, "memory_total_mb": 8192, "top_consumer": "cef"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T06:43:26.016611Z", "process": "ospf", "pid": 922, "crash_count_24h": 24, "last_crash_reason": "Watchdog timeout", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "process": "ospf", "pid": 922, "crash_count_24h": 24, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T04:16:26.010910Z", "memory_used_percent": 93, "memory_free_mb": 239, "memory_total_mb": 4096, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "memory_used_percent": 93, "memory_free_mb": 239, "memory_total_mb": 4096, "top_consumer": "logging"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:49:26.008924Z", "memory_used_percent": 94, "memory_free_mb": 73, "memory_total_mb": 2048, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 94, "memory_free_mb": 73, "memory_total_mb": 2048, "top_consumer": "ospf"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:01:26.017265Z", "process": "netconf", "pid": 3004, "crash_count_24h": 9, "last_crash_reason": "Unhandled exception", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "netconf", "pid": 3004, "crash_count_24h": 9, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T02:54:26.006320Z", "cpu_5s_percent": 89, "cpu_1m_percent": 89, "cpu_5m_percent": 77, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 89, "cpu_1m_percent": 89, "cpu_5m_percent": 77, "top_process": "SSH Process"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:19:26.007411Z", "cpu_5s_percent": 94, "cpu_1m_percent": 78, "cpu_5m_percent": 75, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 94, "cpu_1m_percent": 78, "cpu_5m_percent": 75, "top_process": "IP Input"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T06:52:26.013580Z", "process": "crypto", "pid": 1574, "crash_count_24h": 17, "last_crash_reason": "Segmentation fault", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "crypto", "pid": 1574, "crash_count_24h": 17, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T05:47:26.008942Z", "memory_used_percent": 96, "memory_free_mb": 440, "memory_total_mb": 8192, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 96, "memory_free_mb": 440, "memory_total_mb": 8192, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T10:34:26.013964Z", "process": "bgp", "pid": 284, "crash_count_24h": 18, "last_crash_reason": "Unhandled exception", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "bgp", "pid": 284, "crash_count_24h": 18, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:32:26.010832Z", "memory_used_percent": 87, "memory_free_mb": 347, "memory_total_mb": 1024, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 87, "memory_free_mb": 347, "memory_total_mb": 1024, "top_consumer": "telemetry"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:49:26.011447Z", "memory_used_percent": 84, "memory_free_mb": 190, "memory_total_mb": 1024, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 84, "memory_free_mb": 190, "memory_total_mb": 1024, "top_consumer": "telemetry"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T06:36:26.007034Z", "cpu_5s_percent": 98, "cpu_1m_percent": 77, "cpu_5m_percent": 68, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 98, "cpu_1m_percent": 77, "cpu_5m_percent": 68, "top_process": "ARP Input"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:31:26.010040Z", "memory_used_percent": 93, "memory_free_mb": 455, "memory_total_mb": 1024, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 93, "memory_free_mb": 455, "memory_total_mb": 1024, "top_consumer": "ospf"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T06:08:26.014746Z", "process": "snmpd", "pid": 4603, "crash_count_24h": 13, "last_crash_reason": "Watchdog timeout", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 4603, "crash_count_24h": 13, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T01:23:26.013036Z", "process": "snmpd", "pid": 2722, "crash_count_24h": 17, "last_crash_reason": "Unhandled exception", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 2722, "crash_count_24h": 17, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T06:35:26.014800Z", "process": "crypto", "pid": 3419, "crash_count_24h": 8, "last_crash_reason": "Watchdog timeout", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "process": "crypto", "pid": 3419, "crash_count_24h": 8, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T07:00:26.006780Z", "cpu_5s_percent": 92, "cpu_1m_percent": 81, "cpu_5m_percent": 75, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 92, "cpu_1m_percent": 81, "cpu_5m_percent": 75, "top_process": "Crypto IKEv2"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:00:26.014081Z", "process": "netconf", "pid": 1190, "crash_count_24h": 18, "last_crash_reason": "Unhandled exception", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "netconf", "pid": 1190, "crash_count_24h": 18, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:18:26.010511Z", "memory_used_percent": 88, "memory_free_mb": 174, "memory_total_mb": 1024, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 88, "memory_free_mb": 174, "memory_total_mb": 1024, "top_consumer": "telemetry"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T08:37:26.013396Z", "process": "bgp", "pid": 176, "crash_count_24h": 18, "last_crash_reason": "Memory corruption", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "process": "bgp", "pid": 176, "crash_count_24h": 18, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:25:26.008700Z", "memory_used_percent": 91, "memory_free_mb": 119, "memory_total_mb": 8192, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 91, "memory_free_mb": 119, "memory_total_mb": 8192, "top_consumer": "crypto"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T04:10:26.006946Z", "cpu_5s_percent": 93, "cpu_1m_percent": 78, "cpu_5m_percent": 72, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 93, "cpu_1m_percent": 78, "cpu_5m_percent": 72, "top_process": "BGP Scanner"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T10:17:26.009614Z", "memory_used_percent": 93, "memory_free_mb": 236, "memory_total_mb": 8192, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "memory_used_percent": 93, "memory_free_mb": 236, "memory_total_mb": 8192, "top_consumer": "ospf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T04:39:26.007929Z", "cpu_5s_percent": 94, "cpu_1m_percent": 84, "cpu_5m_percent": 79, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 94, "cpu_1m_percent": 84, "cpu_5m_percent": 79, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:56:26.005838Z", "cpu_5s_percent": 85, "cpu_1m_percent": 79, "cpu_5m_percent": 93, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 85, "cpu_1m_percent": 79, "cpu_5m_percent": 93, "top_process": "QoS Stats"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T02:26:26.015974Z", "process": "telemetry", "pid": 2128, "crash_count_24h": 5, "last_crash_reason": "Unhandled exception", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "process": "telemetry", "pid": 2128, "crash_count_24h": 5, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T01:41:26.013973Z", "process": "crypto", "pid": 1371, "crash_count_24h": 10, "last_crash_reason": "Watchdog timeout", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "crypto", "pid": 1371, "crash_count_24h": 10, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T07:08:26.010254Z", "memory_used_percent": 87, "memory_free_mb": 423, "memory_total_mb": 4096, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 87, "memory_free_mb": 423, "memory_total_mb": 4096, "top_consumer": "qos"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:52:26.010051Z", "memory_used_percent": 84, "memory_free_mb": 258, "memory_total_mb": 4096, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "memory_used_percent": 84, "memory_free_mb": 258, "memory_total_mb": 4096, "top_consumer": "snmp"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T02:01:26.013835Z", "process": "snmpd", "pid": 4509, "crash_count_24h": 5, "last_crash_reason": "Memory corruption", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 4509, "crash_count_24h": 5, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:56:26.007436Z", "cpu_5s_percent": 92, "cpu_1m_percent": 82, "cpu_5m_percent": 88, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 92, "cpu_1m_percent": 82, "cpu_5m_percent": 88, "top_process": "BGP Scanner"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:58:26.013436Z", "process": "telemetry", "pid": 2331, "crash_count_24h": 21, "last_crash_reason": "Unhandled exception", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 2331, "crash_count_24h": 21, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:12:26.010031Z", "memory_used_percent": 93, "memory_free_mb": 306, "memory_total_mb": 4096, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "memory_used_percent": 93, "memory_free_mb": 306, "memory_total_mb": 4096, "top_consumer": "crypto"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T07:04:26.008319Z", "cpu_5s_percent": 92, "cpu_1m_percent": 95, "cpu_5m_percent": 85, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 92, "cpu_1m_percent": 95, "cpu_5m_percent": 85, "top_process": "BGP Scanner"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T01:44:26.013486Z", "process": "telemetry", "pid": 1025, "crash_count_24h": 15, "last_crash_reason": "Segmentation fault", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "process": "telemetry", "pid": 1025, "crash_count_24h": 15, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T07:55:26.011098Z", "memory_used_percent": 93, "memory_free_mb": 180, "memory_total_mb": 4096, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 93, "memory_free_mb": 180, "memory_total_mb": 4096, "top_consumer": "telemetry"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:24:26.007878Z", "cpu_5s_percent": 93, "cpu_1m_percent": 81, "cpu_5m_percent": 67, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 93, "cpu_1m_percent": 81, "cpu_5m_percent": 67, "top_process": "Crypto IKEv2"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:36:26.010554Z", "memory_used_percent": 88, "memory_free_mb": 60, "memory_total_mb": 1024, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 88, "memory_free_mb": 60, "memory_total_mb": 1024, "top_consumer": "qos"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T08:59:26.013611Z", "process": "iosd", "pid": 4365, "crash_count_24h": 14, "last_crash_reason": "Segmentation fault", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "iosd", "pid": 4365, "crash_count_24h": 14, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:02:26.008592Z", "memory_used_percent": 89, "memory_free_mb": 500, "memory_total_mb": 8192, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 89, "memory_free_mb": 500, "memory_total_mb": 8192, "top_consumer": "snmp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T01:35:26.009925Z", "memory_used_percent": 91, "memory_free_mb": 406, "memory_total_mb": 8192, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 91, "memory_free_mb": 406, "memory_total_mb": 8192, "top_consumer": "crypto"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:21:26.004831Z", "cpu_5s_percent": 90, "cpu_1m_percent": 94, "cpu_5m_percent": 68, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 90, "cpu_1m_percent": 94, "cpu_5m_percent": 68, "top_process": "BGP Scanner"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T07:42:26.004732Z", "cpu_5s_percent": 86, "cpu_1m_percent": 87, "cpu_5m_percent": 75, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 86, "cpu_1m_percent": 87, "cpu_5m_percent": 75, "top_process": "SSH Process"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T09:17:26.008720Z", "memory_used_percent": 96, "memory_free_mb": 131, "memory_total_mb": 4096, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "memory_used_percent": 96, "memory_free_mb": 131, "memory_total_mb": 4096, "top_consumer": "telemetry"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T02:09:26.011177Z", "memory_used_percent": 84, "memory_free_mb": 443, "memory_total_mb": 4096, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 84, "memory_free_mb": 443, "memory_total_mb": 4096, "top_consumer": "cef"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T06:33:26.009135Z", "memory_used_percent": 86, "memory_free_mb": 161, "memory_total_mb": 2048, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 86, "memory_free_mb": 161, "memory_total_mb": 2048, "top_consumer": "crypto"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T09:17:26.004797Z", "cpu_5s_percent": 95, "cpu_1m_percent": 84, "cpu_5m_percent": 88, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 95, "cpu_1m_percent": 84, "cpu_5m_percent": 88, "top_process": "Crypto IKEv2"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T09:47:26.007169Z", "cpu_5s_percent": 99, "cpu_1m_percent": 76, "cpu_5m_percent": 81, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "cpu_5s_percent": 99, "cpu_1m_percent": 76, "cpu_5m_percent": 81, "top_process": "CEF RP"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:47:26.007072Z", "cpu_5s_percent": 90, "cpu_1m_percent": 87, "cpu_5m_percent": 95, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 90, "cpu_1m_percent": 87, "cpu_5m_percent": 95, "top_process": "IP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T11:10:26.011356Z", "memory_used_percent": 91, "memory_free_mb": 388, "memory_total_mb": 1024, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "memory_used_percent": 91, "memory_free_mb": 388, "memory_total_mb": 1024, "top_consumer": "netconf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T06:29:26.006711Z", "cpu_5s_percent": 85, "cpu_1m_percent": 99, "cpu_5m_percent": 89, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 85, "cpu_1m_percent": 99, "cpu_5m_percent": 89, "top_process": "QoS Stats"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T07:40:26.009168Z", "memory_used_percent": 89, "memory_free_mb": 344, "memory_total_mb": 1024, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "memory_used_percent": 89, "memory_free_mb": 344, "memory_total_mb": 1024, "top_consumer": "bgp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:07:26.015763Z", "process": "iosd", "pid": 4020, "crash_count_24h": 22, "last_crash_reason": "Unhandled exception", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 4020, "crash_count_24h": 22, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:24:26.005738Z", "cpu_5s_percent": 91, "cpu_1m_percent": 98, "cpu_5m_percent": 71, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 91, "cpu_1m_percent": 98, "cpu_5m_percent": 71, "top_process": "BGP Scanner"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T07:01:26.005848Z", "cpu_5s_percent": 87, "cpu_1m_percent": 80, "cpu_5m_percent": 82, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "cpu_5s_percent": 87, "cpu_1m_percent": 80, "cpu_5m_percent": 82, "top_process": "CEF RP"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T02:08:26.004909Z", "cpu_5s_percent": 85, "cpu_1m_percent": 75, "cpu_5m_percent": 73, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 85, "cpu_1m_percent": 75, "cpu_5m_percent": 73, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:44:26.014360Z", "process": "bgp", "pid": 3774, "crash_count_24h": 8, "last_crash_reason": "Watchdog timeout", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "process": "bgp", "pid": 3774, "crash_count_24h": 8, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T10:12:26.006730Z", "cpu_5s_percent": 97, "cpu_1m_percent": 97, "cpu_5m_percent": 66, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 97, "cpu_1m_percent": 97, "cpu_5m_percent": 66, "top_process": "SSH Process"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T08:47:26.007690Z", "cpu_5s_percent": 95, "cpu_1m_percent": 84, "cpu_5m_percent": 86, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 95, "cpu_1m_percent": 84, "cpu_5m_percent": 86, "top_process": "CEF RP"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T11:19:26.010694Z", "memory_used_percent": 88, "memory_free_mb": 210, "memory_total_mb": 8192, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 88, "memory_free_mb": 210, "memory_total_mb": 8192, "top_consumer": "bgp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:33:26.005547Z", "cpu_5s_percent": 92, "cpu_1m_percent": 90, "cpu_5m_percent": 86, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "cpu_5s_percent": 92, "cpu_1m_percent": 90, "cpu_5m_percent": 86, "top_process": "QoS Stats"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:15:26.015714Z", "process": "bgp", "pid": 1550, "crash_count_24h": 18, "last_crash_reason": "Memory corruption", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "bgp", "pid": 1550, "crash_count_24h": 18, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T04:04:26.014274Z", "process": "iosd", "pid": 2978, "crash_count_24h": 16, "last_crash_reason": "Memory corruption", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "iosd", "pid": 2978, "crash_count_24h": 16, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T05:00:26.015753Z", "process": "bgp", "pid": 541, "crash_count_24h": 12, "last_crash_reason": "Memory corruption", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "process": "bgp", "pid": 541, "crash_count_24h": 12, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T06:51:26.015089Z", "process": "telemetry", "pid": 555, "crash_count_24h": 14, "last_crash_reason": "Segmentation fault", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 555, "crash_count_24h": 14, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T10:45:26.014440Z", "process": "crypto", "pid": 2303, "crash_count_24h": 14, "last_crash_reason": "Segmentation fault", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "crypto", "pid": 2303, "crash_count_24h": 14, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T04:02:26.010929Z", "memory_used_percent": 83, "memory_free_mb": 436, "memory_total_mb": 4096, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 83, "memory_free_mb": 436, "memory_total_mb": 4096, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:50:26.006254Z", "cpu_5s_percent": 88, "cpu_1m_percent": 78, "cpu_5m_percent": 72, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 88, "cpu_1m_percent": 78, "cpu_5m_percent": 72, "top_process": "Net Background"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T05:49:26.005641Z", "cpu_5s_percent": 100, "cpu_1m_percent": 79, "cpu_5m_percent": 82, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 100, "cpu_1m_percent": 79, "cpu_5m_percent": 82, "top_process": "Crypto IKEv2"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T02:47:26.011731Z", "memory_used_percent": 95, "memory_free_mb": 451, "memory_total_mb": 2048, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "memory_used_percent": 95, "memory_free_mb": 451, "memory_total_mb": 2048, "top_consumer": "telemetry"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T10:44:26.005446Z", "cpu_5s_percent": 100, "cpu_1m_percent": 85, "cpu_5m_percent": 65, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 100, "cpu_1m_percent": 85, "cpu_5m_percent": 65, "top_process": "Net Background"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:24:26.016591Z", "process": "iosd", "pid": 2067, "crash_count_24h": 2, "last_crash_reason": "Unhandled exception", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "process": "iosd", "pid": 2067, "crash_count_24h": 2, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:07:26.015318Z", "process": "ospf", "pid": 1043, "crash_count_24h": 11, "last_crash_reason": "Unhandled exception", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "ospf", "pid": 1043, "crash_count_24h": 11, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T04:59:26.010787Z", "memory_used_percent": 95, "memory_free_mb": 293, "memory_total_mb": 4096, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "memory_used_percent": 95, "memory_free_mb": 293, "memory_total_mb": 4096, "top_consumer": "cef"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T08:42:26.008406Z", "cpu_5s_percent": 95, "cpu_1m_percent": 92, "cpu_5m_percent": 65, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 95, "cpu_1m_percent": 92, "cpu_5m_percent": 65, "top_process": "OSPF-1 Router"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T03:08:26.005904Z", "cpu_5s_percent": 100, "cpu_1m_percent": 93, "cpu_5m_percent": 77, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 100, "cpu_1m_percent": 93, "cpu_5m_percent": 77, "top_process": "SSH Process"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T07:26:26.014944Z", "process": "ospf", "pid": 1145, "crash_count_24h": 10, "last_crash_reason": "Watchdog timeout", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "process": "ospf", "pid": 1145, "crash_count_24h": 10, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T10:46:26.017183Z", "process": "snmpd", "pid": 4255, "crash_count_24h": 11, "last_crash_reason": "Unhandled exception", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "snmpd", "pid": 4255, "crash_count_24h": 11, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:32:26.010994Z", "memory_used_percent": 80, "memory_free_mb": 98, "memory_total_mb": 2048, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "memory_used_percent": 80, "memory_free_mb": 98, "memory_total_mb": 2048, "top_consumer": "qos"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:04:26.008191Z", "cpu_5s_percent": 86, "cpu_1m_percent": 98, "cpu_5m_percent": 77, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 86, "cpu_1m_percent": 98, "cpu_5m_percent": 77, "top_process": "SSH Process"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T06:55:26.011374Z", "memory_used_percent": 87, "memory_free_mb": 302, "memory_total_mb": 4096, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 87, "memory_free_mb": 302, "memory_total_mb": 4096, "top_consumer": "cef"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:29:26.013649Z", "process": "iosd", "pid": 4576, "crash_count_24h": 21, "last_crash_reason": "Memory corruption", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "iosd", "pid": 4576, "crash_count_24h": 21, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T09:17:26.012777Z", "process": "telemetry", "pid": 2031, "crash_count_24h": 7, "last_crash_reason": "Segmentation fault", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "process": "telemetry", "pid": 2031, "crash_count_24h": 7, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T02:07:26.014785Z", "process": "telemetry", "pid": 1997, "crash_count_24h": 13, "last_crash_reason": "Segmentation fault", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "telemetry", "pid": 1997, "crash_count_24h": 13, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T10:59:26.007223Z", "cpu_5s_percent": 88, "cpu_1m_percent": 84, "cpu_5m_percent": 80, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 88, "cpu_1m_percent": 84, "cpu_5m_percent": 80, "top_process": "OSPF-1 Router"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T10:35:26.009423Z", "memory_used_percent": 90, "memory_free_mb": 160, "memory_total_mb": 4096, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 90, "memory_free_mb": 160, "memory_total_mb": 4096, "top_consumer": "snmp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:10:26.011472Z", "memory_used_percent": 89, "memory_free_mb": 76, "memory_total_mb": 8192, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "memory_used_percent": 89, "memory_free_mb": 76, "memory_total_mb": 8192, "top_consumer": "cef"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:35:26.015912Z", "process": "snmpd", "pid": 1236, "crash_count_24h": 2, "last_crash_reason": "Unhandled exception", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "snmpd", "pid": 1236, "crash_count_24h": 2, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:26:26.010703Z", "memory_used_percent": 84, "memory_free_mb": 215, "memory_total_mb": 2048, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 84, "memory_free_mb": 215, "memory_total_mb": 2048, "top_consumer": "snmp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T04:56:26.009230Z", "memory_used_percent": 93, "memory_free_mb": 362, "memory_total_mb": 8192, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 93, "memory_free_mb": 362, "memory_total_mb": 8192, "top_consumer": "snmp"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:49:26.006721Z", "cpu_5s_percent": 86, "cpu_1m_percent": 88, "cpu_5m_percent": 74, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 86, "cpu_1m_percent": 88, "cpu_5m_percent": 74, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:40:26.005874Z", "cpu_5s_percent": 88, "cpu_1m_percent": 98, "cpu_5m_percent": 95, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "cpu_5s_percent": 88, "cpu_1m_percent": 98, "cpu_5m_percent": 95, "top_process": "SSH Process"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:29:26.014168Z", "process": "snmpd", "pid": 4578, "crash_count_24h": 16, "last_crash_reason": "Memory corruption", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 4578, "crash_count_24h": 16, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T02:21:26.007462Z", "cpu_5s_percent": 90, "cpu_1m_percent": 78, "cpu_5m_percent": 71, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 90, "cpu_1m_percent": 78, "cpu_5m_percent": 71, "top_process": "BGP Scanner"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T04:59:26.011490Z", "memory_used_percent": 91, "memory_free_mb": 233, "memory_total_mb": 4096, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "memory_used_percent": 91, "memory_free_mb": 233, "memory_total_mb": 4096, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T07:52:26.008991Z", "memory_used_percent": 97, "memory_free_mb": 446, "memory_total_mb": 1024, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 97, "memory_free_mb": 446, "memory_total_mb": 1024, "top_consumer": "netconf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T01:58:26.010061Z", "memory_used_percent": 91, "memory_free_mb": 149, "memory_total_mb": 8192, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 91, "memory_free_mb": 149, "memory_total_mb": 8192, "top_consumer": "netconf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T11:19:26.011499Z", "memory_used_percent": 95, "memory_free_mb": 485, "memory_total_mb": 4096, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 95, "memory_free_mb": 485, "memory_total_mb": 4096, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T06:28:26.010021Z", "memory_used_percent": 87, "memory_free_mb": 490, "memory_total_mb": 8192, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 87, "memory_free_mb": 490, "memory_total_mb": 8192, "top_consumer": "telemetry"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T09:05:26.009443Z", "memory_used_percent": 98, "memory_free_mb": 104, "memory_total_mb": 8192, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 98, "memory_free_mb": 104, "memory_total_mb": 8192, "top_consumer": "logging"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T06:20:26.016005Z", "process": "telemetry", "pid": 981, "crash_count_24h": 7, "last_crash_reason": "Watchdog timeout", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "process": "telemetry", "pid": 981, "crash_count_24h": 7, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:06:26.010571Z", "memory_used_percent": 81, "memory_free_mb": 438, "memory_total_mb": 1024, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "memory_used_percent": 81, "memory_free_mb": 438, "memory_total_mb": 1024, "top_consumer": "bgp"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T07:55:26.006861Z", "cpu_5s_percent": 87, "cpu_1m_percent": 81, "cpu_5m_percent": 85, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 87, "cpu_1m_percent": 81, "cpu_5m_percent": 85, "top_process": "CEF RP"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T08:38:26.007328Z", "cpu_5s_percent": 99, "cpu_1m_percent": 96, "cpu_5m_percent": 86, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 99, "cpu_1m_percent": 96, "cpu_5m_percent": 86, "top_process": "BGP Scanner"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T10:05:26.006486Z", "cpu_5s_percent": 92, "cpu_1m_percent": 86, "cpu_5m_percent": 94, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 92, "cpu_1m_percent": 86, "cpu_5m_percent": 94, "top_process": "BGP Scanner"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T06:49:26.014685Z", "process": "crypto", "pid": 981, "crash_count_24h": 25, "last_crash_reason": "Segmentation fault", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "process": "crypto", "pid": 981, "crash_count_24h": 25, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T05:26:26.005244Z", "cpu_5s_percent": 99, "cpu_1m_percent": 82, "cpu_5m_percent": 92, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 99, "cpu_1m_percent": 82, "cpu_5m_percent": 92, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T03:12:26.016118Z", "process": "netconf", "pid": 3646, "crash_count_24h": 8, "last_crash_reason": "Segmentation fault", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "netconf", "pid": 3646, "crash_count_24h": 8, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T06:55:26.014264Z", "process": "telemetry", "pid": 3475, "crash_count_24h": 16, "last_crash_reason": "Watchdog timeout", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "process": "telemetry", "pid": 3475, "crash_count_24h": 16, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T05:34:26.013700Z", "process": "snmpd", "pid": 1472, "crash_count_24h": 22, "last_crash_reason": "Watchdog timeout", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 1472, "crash_count_24h": 22, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:41:26.010607Z", "memory_used_percent": 82, "memory_free_mb": 136, "memory_total_mb": 1024, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "memory_used_percent": 82, "memory_free_mb": 136, "memory_total_mb": 1024, "top_consumer": "logging"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:41:26.009674Z", "memory_used_percent": 80, "memory_free_mb": 454, "memory_total_mb": 2048, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "memory_used_percent": 80, "memory_free_mb": 454, "memory_total_mb": 2048, "top_consumer": "bgp"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:57:26.006476Z", "cpu_5s_percent": 90, "cpu_1m_percent": 75, "cpu_5m_percent": 92, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 90, "cpu_1m_percent": 75, "cpu_5m_percent": 92, "top_process": "ARP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T05:40:26.014817Z", "process": "telemetry", "pid": 3549, "crash_count_24h": 9, "last_crash_reason": "Segmentation fault", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "telemetry", "pid": 3549, "crash_count_24h": 9, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:43:26.012051Z", "memory_used_percent": 80, "memory_free_mb": 117, "memory_total_mb": 2048, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 80, "memory_free_mb": 117, "memory_total_mb": 2048, "top_consumer": "logging"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:09:26.014402Z", "process": "telemetry", "pid": 4995, "crash_count_24h": 11, "last_crash_reason": "Watchdog timeout", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "telemetry", "pid": 4995, "crash_count_24h": 11, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T02:42:26.009021Z", "memory_used_percent": 80, "memory_free_mb": 236, "memory_total_mb": 1024, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 80, "memory_free_mb": 236, "memory_total_mb": 1024, "top_consumer": "cef"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T05:50:26.005689Z", "cpu_5s_percent": 98, "cpu_1m_percent": 79, "cpu_5m_percent": 93, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 98, "cpu_1m_percent": 79, "cpu_5m_percent": 93, "top_process": "Net Background"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T04:08:26.007859Z", "cpu_5s_percent": 87, "cpu_1m_percent": 95, "cpu_5m_percent": 94, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 87, "cpu_1m_percent": 95, "cpu_5m_percent": 94, "top_process": "IP Input"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T08:24:26.014756Z", "process": "netconf", "pid": 338, "crash_count_24h": 23, "last_crash_reason": "Segmentation fault", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "netconf", "pid": 338, "crash_count_24h": 23, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:29:26.008558Z", "memory_used_percent": 83, "memory_free_mb": 300, "memory_total_mb": 8192, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 83, "memory_free_mb": 300, "memory_total_mb": 8192, "top_consumer": "cef"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T05:50:26.012195Z", "memory_used_percent": 95, "memory_free_mb": 213, "memory_total_mb": 1024, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 95, "memory_free_mb": 213, "memory_total_mb": 1024, "top_consumer": "crypto"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T03:12:26.014705Z", "process": "bgp", "pid": 810, "crash_count_24h": 17, "last_crash_reason": "Unhandled exception", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "process": "bgp", "pid": 810, "crash_count_24h": 17, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T06:24:26.008570Z", "memory_used_percent": 80, "memory_free_mb": 433, "memory_total_mb": 4096, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 80, "memory_free_mb": 433, "memory_total_mb": 4096, "top_consumer": "bgp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T10:13:26.016147Z", "process": "netconf", "pid": 3705, "crash_count_24h": 13, "last_crash_reason": "Segmentation fault", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "process": "netconf", "pid": 3705, "crash_count_24h": 13, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T01:30:26.011437Z", "memory_used_percent": 91, "memory_free_mb": 234, "memory_total_mb": 8192, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 91, "memory_free_mb": 234, "memory_total_mb": 8192, "top_consumer": "cef"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T02:28:26.007393Z", "cpu_5s_percent": 89, "cpu_1m_percent": 87, "cpu_5m_percent": 70, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "cpu_5s_percent": 89, "cpu_1m_percent": 87, "cpu_5m_percent": 70, "top_process": "Crypto IKEv2"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T03:38:26.007751Z", "cpu_5s_percent": 97, "cpu_1m_percent": 86, "cpu_5m_percent": 95, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 97, "cpu_1m_percent": 86, "cpu_5m_percent": 95, "top_process": "Crypto IKEv2"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T04:35:26.013906Z", "process": "telemetry", "pid": 507, "crash_count_24h": 16, "last_crash_reason": "Watchdog timeout", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 507, "crash_count_24h": 16, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T02:18:26.006172Z", "cpu_5s_percent": 90, "cpu_1m_percent": 84, "cpu_5m_percent": 88, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 90, "cpu_1m_percent": 84, "cpu_5m_percent": 88, "top_process": "Crypto IKEv2"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:11:26.007471Z", "cpu_5s_percent": 86, "cpu_1m_percent": 75, "cpu_5m_percent": 70, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 86, "cpu_1m_percent": 75, "cpu_5m_percent": 70, "top_process": "Net Background"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:03:26.014626Z", "process": "crypto", "pid": 1872, "crash_count_24h": 9, "last_crash_reason": "Segmentation fault", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "crypto", "pid": 1872, "crash_count_24h": 9, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T09:26:26.010520Z", "memory_used_percent": 99, "memory_free_mb": 306, "memory_total_mb": 2048, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "memory_used_percent": 99, "memory_free_mb": 306, "memory_total_mb": 2048, "top_consumer": "netconf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T03:49:26.007150Z", "cpu_5s_percent": 97, "cpu_1m_percent": 81, "cpu_5m_percent": 89, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 97, "cpu_1m_percent": 81, "cpu_5m_percent": 89, "top_process": "OSPF-1 Router"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:10:26.011296Z", "memory_used_percent": 87, "memory_free_mb": 496, "memory_total_mb": 2048, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 87, "memory_free_mb": 496, "memory_total_mb": 2048, "top_consumer": "cef"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T11:01:26.009605Z", "memory_used_percent": 84, "memory_free_mb": 330, "memory_total_mb": 2048, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "memory_used_percent": 84, "memory_free_mb": 330, "memory_total_mb": 2048, "top_consumer": "bgp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T09:29:26.008642Z", "memory_used_percent": 95, "memory_free_mb": 350, "memory_total_mb": 1024, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 95, "memory_free_mb": 350, "memory_total_mb": 1024, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T07:00:26.004697Z", "cpu_5s_percent": 95, "cpu_1m_percent": 80, "cpu_5m_percent": 73, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 95, "cpu_1m_percent": 80, "cpu_5m_percent": 73, "top_process": "Crypto IKEv2"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T04:25:26.016555Z", "process": "iosd", "pid": 2997, "crash_count_24h": 14, "last_crash_reason": "Memory corruption", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 2997, "crash_count_24h": 14, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T06:23:26.009755Z", "memory_used_percent": 98, "memory_free_mb": 459, "memory_total_mb": 2048, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 98, "memory_free_mb": 459, "memory_total_mb": 2048, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T06:15:26.016354Z", "process": "crypto", "pid": 1420, "crash_count_24h": 17, "last_crash_reason": "Watchdog timeout", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "crypto", "pid": 1420, "crash_count_24h": 17, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T06:07:26.008291Z", "cpu_5s_percent": 87, "cpu_1m_percent": 92, "cpu_5m_percent": 65, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 87, "cpu_1m_percent": 92, "cpu_5m_percent": 65, "top_process": "SSH Process"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T04:08:26.010265Z", "memory_used_percent": 94, "memory_free_mb": 412, "memory_total_mb": 1024, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 94, "memory_free_mb": 412, "memory_total_mb": 1024, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T06:55:26.008226Z", "cpu_5s_percent": 98, "cpu_1m_percent": 97, "cpu_5m_percent": 71, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 98, "cpu_1m_percent": 97, "cpu_5m_percent": 71, "top_process": "BGP Scanner"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T02:59:26.008629Z", "memory_used_percent": 81, "memory_free_mb": 210, "memory_total_mb": 1024, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 81, "memory_free_mb": 210, "memory_total_mb": 1024, "top_consumer": "crypto"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T05:10:26.006369Z", "cpu_5s_percent": 98, "cpu_1m_percent": 87, "cpu_5m_percent": 84, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 98, "cpu_1m_percent": 87, "cpu_5m_percent": 84, "top_process": "QoS Stats"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T09:14:26.012731Z", "process": "crypto", "pid": 664, "crash_count_24h": 14, "last_crash_reason": "Memory corruption", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "process": "crypto", "pid": 664, "crash_count_24h": 14, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T05:48:26.005564Z", "cpu_5s_percent": 100, "cpu_1m_percent": 83, "cpu_5m_percent": 80, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 100, "cpu_1m_percent": 83, "cpu_5m_percent": 80, "top_process": "SSH Process"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:03:26.007987Z", "cpu_5s_percent": 91, "cpu_1m_percent": 90, "cpu_5m_percent": 68, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 91, "cpu_1m_percent": 90, "cpu_5m_percent": 68, "top_process": "SSH Process"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T08:28:26.005512Z", "cpu_5s_percent": 99, "cpu_1m_percent": 81, "cpu_5m_percent": 84, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 99, "cpu_1m_percent": 81, "cpu_5m_percent": 84, "top_process": "SNMP ENGINE"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T06:38:26.009126Z", "memory_used_percent": 94, "memory_free_mb": 221, "memory_total_mb": 4096, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "memory_used_percent": 94, "memory_free_mb": 221, "memory_total_mb": 4096, "top_consumer": "crypto"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:47:26.008980Z", "memory_used_percent": 84, "memory_free_mb": 265, "memory_total_mb": 4096, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 84, "memory_free_mb": 265, "memory_total_mb": 4096, "top_consumer": "netconf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T02:37:26.015515Z", "process": "ospf", "pid": 701, "crash_count_24h": 6, "last_crash_reason": "Memory corruption", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "process": "ospf", "pid": 701, "crash_count_24h": 6, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T07:32:26.007006Z", "cpu_5s_percent": 92, "cpu_1m_percent": 98, "cpu_5m_percent": 89, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 92, "cpu_1m_percent": 98, "cpu_5m_percent": 89, "top_process": "OSPF-1 Router"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T06:45:26.009982Z", "memory_used_percent": 94, "memory_free_mb": 277, "memory_total_mb": 2048, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "memory_used_percent": 94, "memory_free_mb": 277, "memory_total_mb": 2048, "top_consumer": "qos"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T08:30:26.010598Z", "memory_used_percent": 96, "memory_free_mb": 281, "memory_total_mb": 2048, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "memory_used_percent": 96, "memory_free_mb": 281, "memory_total_mb": 2048, "top_consumer": "bgp"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T11:17:26.016601Z", "process": "ospf", "pid": 2422, "crash_count_24h": 2, "last_crash_reason": "Unhandled exception", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "process": "ospf", "pid": 2422, "crash_count_24h": 2, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T08:47:26.011167Z", "memory_used_percent": 95, "memory_free_mb": 395, "memory_total_mb": 4096, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 95, "memory_free_mb": 395, "memory_total_mb": 4096, "top_consumer": "ospf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T01:42:26.005278Z", "cpu_5s_percent": 89, "cpu_1m_percent": 89, "cpu_5m_percent": 88, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 89, "cpu_1m_percent": 89, "cpu_5m_percent": 88, "top_process": "SNMP ENGINE"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T03:48:26.012372Z", "memory_used_percent": 98, "memory_free_mb": 471, "memory_total_mb": 1024, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "memory_used_percent": 98, "memory_free_mb": 471, "memory_total_mb": 1024, "top_consumer": "crypto"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T01:50:26.014909Z", "process": "telemetry", "pid": 1441, "crash_count_24h": 20, "last_crash_reason": "Segmentation fault", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "process": "telemetry", "pid": 1441, "crash_count_24h": 20, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:49:26.009199Z", "memory_used_percent": 91, "memory_free_mb": 372, "memory_total_mb": 4096, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 91, "memory_free_mb": 372, "memory_total_mb": 4096, "top_consumer": "ospf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T02:09:26.005661Z", "cpu_5s_percent": 90, "cpu_1m_percent": 79, "cpu_5m_percent": 73, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 90, "cpu_1m_percent": 79, "cpu_5m_percent": 73, "top_process": "Crypto IKEv2"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T05:34:26.011931Z", "memory_used_percent": 99, "memory_free_mb": 351, "memory_total_mb": 2048, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 99, "memory_free_mb": 351, "memory_total_mb": 2048, "top_consumer": "snmp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T06:45:26.005529Z", "cpu_5s_percent": 89, "cpu_1m_percent": 78, "cpu_5m_percent": 65, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 89, "cpu_1m_percent": 78, "cpu_5m_percent": 65, "top_process": "QoS Stats"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T09:29:26.012899Z", "process": "telemetry", "pid": 2233, "crash_count_24h": 10, "last_crash_reason": "Memory corruption", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 2233, "crash_count_24h": 10, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T03:31:26.014381Z", "process": "telemetry", "pid": 1888, "crash_count_24h": 16, "last_crash_reason": "Memory corruption", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "process": "telemetry", "pid": 1888, "crash_count_24h": 16, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:56:26.012283Z", "memory_used_percent": 84, "memory_free_mb": 239, "memory_total_mb": 1024, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 84, "memory_free_mb": 239, "memory_total_mb": 1024, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T04:34:26.004178Z", "cpu_5s_percent": 99, "cpu_1m_percent": 88, "cpu_5m_percent": 67, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 99, "cpu_1m_percent": 88, "cpu_5m_percent": 67, "top_process": "ARP Input"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T02:20:26.014129Z", "process": "snmpd", "pid": 421, "crash_count_24h": 9, "last_crash_reason": "Segmentation fault", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "snmpd", "pid": 421, "crash_count_24h": 9, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T06:05:26.015195Z", "process": "ospf", "pid": 4626, "crash_count_24h": 19, "last_crash_reason": "Segmentation fault", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "ospf", "pid": 4626, "crash_count_24h": 19, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T09:18:26.013620Z", "process": "ospf", "pid": 2503, "crash_count_24h": 23, "last_crash_reason": "Watchdog timeout", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "ospf", "pid": 2503, "crash_count_24h": 23, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T06:57:26.006005Z", "cpu_5s_percent": 86, "cpu_1m_percent": 90, "cpu_5m_percent": 94, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 86, "cpu_1m_percent": 90, "cpu_5m_percent": 94, "top_process": "Crypto IKEv2"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:39:26.010380Z", "memory_used_percent": 80, "memory_free_mb": 239, "memory_total_mb": 4096, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 80, "memory_free_mb": 239, "memory_total_mb": 4096, "top_consumer": "netconf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T10:46:26.011306Z", "memory_used_percent": 84, "memory_free_mb": 363, "memory_total_mb": 2048, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 84, "memory_free_mb": 363, "memory_total_mb": 2048, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T04:30:26.017154Z", "process": "ospf", "pid": 2326, "crash_count_24h": 7, "last_crash_reason": "Unhandled exception", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "ospf", "pid": 2326, "crash_count_24h": 7, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T06:14:26.015106Z", "process": "snmpd", "pid": 4404, "crash_count_24h": 18, "last_crash_reason": "Memory corruption", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 4404, "crash_count_24h": 18, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T07:25:26.014898Z", "process": "ospf", "pid": 1474, "crash_count_24h": 4, "last_crash_reason": "Watchdog timeout", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "ospf", "pid": 1474, "crash_count_24h": 4, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T02:36:26.013639Z", "process": "crypto", "pid": 1360, "crash_count_24h": 20, "last_crash_reason": "Watchdog timeout", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "process": "crypto", "pid": 1360, "crash_count_24h": 20, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T01:58:26.009694Z", "memory_used_percent": 93, "memory_free_mb": 310, "memory_total_mb": 8192, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 93, "memory_free_mb": 310, "memory_total_mb": 8192, "top_consumer": "logging"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T10:02:26.005807Z", "cpu_5s_percent": 95, "cpu_1m_percent": 99, "cpu_5m_percent": 73, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 95, "cpu_1m_percent": 99, "cpu_5m_percent": 73, "top_process": "QoS Stats"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:17:26.007214Z", "cpu_5s_percent": 88, "cpu_1m_percent": 91, "cpu_5m_percent": 78, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "cpu_5s_percent": 88, "cpu_1m_percent": 91, "cpu_5m_percent": 78, "top_process": "Net Background"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:44:26.013476Z", "process": "ospf", "pid": 413, "crash_count_24h": 19, "last_crash_reason": "Unhandled exception", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "process": "ospf", "pid": 413, "crash_count_24h": 19, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T04:02:26.010274Z", "memory_used_percent": 87, "memory_free_mb": 379, "memory_total_mb": 4096, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "memory_used_percent": 87, "memory_free_mb": 379, "memory_total_mb": 4096, "top_consumer": "qos"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T07:58:26.014101Z", "process": "ospf", "pid": 1216, "crash_count_24h": 17, "last_crash_reason": "Segmentation fault", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "ospf", "pid": 1216, "crash_count_24h": 17, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T10:56:26.010587Z", "memory_used_percent": 88, "memory_free_mb": 395, "memory_total_mb": 2048, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 88, "memory_free_mb": 395, "memory_total_mb": 2048, "top_consumer": "telemetry"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T04:05:26.015693Z", "process": "iosd", "pid": 2474, "crash_count_24h": 17, "last_crash_reason": "Unhandled exception", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "iosd", "pid": 2474, "crash_count_24h": 17, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T02:08:26.006891Z", "cpu_5s_percent": 95, "cpu_1m_percent": 86, "cpu_5m_percent": 71, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 95, "cpu_1m_percent": 86, "cpu_5m_percent": 71, "top_process": "IP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T07:58:26.004380Z", "cpu_5s_percent": 100, "cpu_1m_percent": 86, "cpu_5m_percent": 94, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 100, "cpu_1m_percent": 86, "cpu_5m_percent": 94, "top_process": "QoS Stats"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T09:34:26.010475Z", "memory_used_percent": 95, "memory_free_mb": 151, "memory_total_mb": 4096, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "memory_used_percent": 95, "memory_free_mb": 151, "memory_total_mb": 4096, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:20:26.006802Z", "cpu_5s_percent": 91, "cpu_1m_percent": 92, "cpu_5m_percent": 73, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "cpu_5s_percent": 91, "cpu_1m_percent": 92, "cpu_5m_percent": 73, "top_process": "OSPF-1 Router"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T02:26:26.016158Z", "process": "telemetry", "pid": 3622, "crash_count_24h": 9, "last_crash_reason": "Segmentation fault", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 3622, "crash_count_24h": 9, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:59:26.005748Z", "cpu_5s_percent": 90, "cpu_1m_percent": 81, "cpu_5m_percent": 85, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 90, "cpu_1m_percent": 81, "cpu_5m_percent": 85, "top_process": "BGP Scanner"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T04:47:26.008282Z", "cpu_5s_percent": 99, "cpu_1m_percent": 89, "cpu_5m_percent": 79, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 99, "cpu_1m_percent": 89, "cpu_5m_percent": 79, "top_process": "Crypto IKEv2"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T10:44:26.015955Z", "process": "iosd", "pid": 914, "crash_count_24h": 17, "last_crash_reason": "Memory corruption", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "process": "iosd", "pid": 914, "crash_count_24h": 17, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:25:26.012998Z", "process": "bgp", "pid": 3941, "crash_count_24h": 5, "last_crash_reason": "Segmentation fault", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "process": "bgp", "pid": 3941, "crash_count_24h": 5, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T06:50:26.004421Z", "cpu_5s_percent": 100, "cpu_1m_percent": 77, "cpu_5m_percent": 85, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 100, "cpu_1m_percent": 77, "cpu_5m_percent": 85, "top_process": "CEF RP"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:34:26.004496Z", "cpu_5s_percent": 91, "cpu_1m_percent": 87, "cpu_5m_percent": 65, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 91, "cpu_1m_percent": 87, "cpu_5m_percent": 65, "top_process": "QoS Stats"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:21:26.004950Z", "cpu_5s_percent": 85, "cpu_1m_percent": 95, "cpu_5m_percent": 72, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 85, "cpu_1m_percent": 95, "cpu_5m_percent": 72, "top_process": "IP Input"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:46:26.016067Z", "process": "snmpd", "pid": 4621, "crash_count_24h": 19, "last_crash_reason": "Memory corruption", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "process": "snmpd", "pid": 4621, "crash_count_24h": 19, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T04:11:26.011088Z", "memory_used_percent": 91, "memory_free_mb": 443, "memory_total_mb": 1024, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 91, "memory_free_mb": 443, "memory_total_mb": 1024, "top_consumer": "cef"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:22:26.007570Z", "cpu_5s_percent": 85, "cpu_1m_percent": 86, "cpu_5m_percent": 87, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 85, "cpu_1m_percent": 86, "cpu_5m_percent": 87, "top_process": "OSPF-1 Router"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T07:50:26.008058Z", "cpu_5s_percent": 88, "cpu_1m_percent": 75, "cpu_5m_percent": 68, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 88, "cpu_1m_percent": 75, "cpu_5m_percent": 68, "top_process": "QoS Stats"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T05:45:26.005380Z", "cpu_5s_percent": 97, "cpu_1m_percent": 75, "cpu_5m_percent": 82, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 97, "cpu_1m_percent": 75, "cpu_5m_percent": 82, "top_process": "CEF RP"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T06:06:26.011137Z", "memory_used_percent": 82, "memory_free_mb": 432, "memory_total_mb": 8192, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 82, "memory_free_mb": 432, "memory_total_mb": 8192, "top_consumer": "ospf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T07:12:26.007160Z", "cpu_5s_percent": 95, "cpu_1m_percent": 86, "cpu_5m_percent": 70, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 95, "cpu_1m_percent": 86, "cpu_5m_percent": 70, "top_process": "BGP Scanner"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T09:56:26.007919Z", "cpu_5s_percent": 99, "cpu_1m_percent": 94, "cpu_5m_percent": 70, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 99, "cpu_1m_percent": 94, "cpu_5m_percent": 70, "top_process": "Net Background"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:53:26.010345Z", "memory_used_percent": 91, "memory_free_mb": 176, "memory_total_mb": 1024, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "memory_used_percent": 91, "memory_free_mb": 176, "memory_total_mb": 1024, "top_consumer": "netconf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T04:55:26.014138Z", "process": "netconf", "pid": 2909, "crash_count_24h": 16, "last_crash_reason": "Memory corruption", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "process": "netconf", "pid": 2909, "crash_count_24h": 16, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:56:26.009685Z", "memory_used_percent": 86, "memory_free_mb": 77, "memory_total_mb": 4096, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "memory_used_percent": 86, "memory_free_mb": 77, "memory_total_mb": 4096, "top_consumer": "bgp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T06:23:26.014726Z", "process": "netconf", "pid": 4831, "crash_count_24h": 12, "last_crash_reason": "Memory corruption", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "netconf", "pid": 4831, "crash_count_24h": 12, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T01:34:26.013026Z", "process": "ospf", "pid": 2024, "crash_count_24h": 22, "last_crash_reason": "Watchdog timeout", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "ospf", "pid": 2024, "crash_count_24h": 22, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:29:26.009941Z", "memory_used_percent": 93, "memory_free_mb": 200, "memory_total_mb": 2048, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 93, "memory_free_mb": 200, "memory_total_mb": 2048, "top_consumer": "logging"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T07:31:26.014158Z", "process": "netconf", "pid": 1967, "crash_count_24h": 9, "last_crash_reason": "Unhandled exception", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "netconf", "pid": 1967, "crash_count_24h": 9, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T10:45:26.013630Z", "process": "telemetry", "pid": 1883, "crash_count_24h": 10, "last_crash_reason": "Memory corruption", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "process": "telemetry", "pid": 1883, "crash_count_24h": 10, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T06:03:26.009575Z", "memory_used_percent": 96, "memory_free_mb": 333, "memory_total_mb": 1024, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "memory_used_percent": 96, "memory_free_mb": 333, "memory_total_mb": 1024, "top_consumer": "netconf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T06:23:26.014888Z", "process": "snmpd", "pid": 1955, "crash_count_24h": 17, "last_crash_reason": "Unhandled exception", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 1955, "crash_count_24h": 17, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T04:00:26.012741Z", "process": "bgp", "pid": 3034, "crash_count_24h": 21, "last_crash_reason": "Watchdog timeout", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "bgp", "pid": 3034, "crash_count_24h": 21, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T02:54:26.009554Z", "memory_used_percent": 95, "memory_free_mb": 91, "memory_total_mb": 2048, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 95, "memory_free_mb": 91, "memory_total_mb": 2048, "top_consumer": "telemetry"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T04:38:26.007507Z", "cpu_5s_percent": 100, "cpu_1m_percent": 84, "cpu_5m_percent": 89, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 100, "cpu_1m_percent": 84, "cpu_5m_percent": 89, "top_process": "OSPF-1 Router"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T10:30:26.007742Z", "cpu_5s_percent": 92, "cpu_1m_percent": 87, "cpu_5m_percent": 88, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "cpu_5s_percent": 92, "cpu_1m_percent": 87, "cpu_5m_percent": 88, "top_process": "SSH Process"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:13:26.009655Z", "memory_used_percent": 81, "memory_free_mb": 136, "memory_total_mb": 4096, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 81, "memory_free_mb": 136, "memory_total_mb": 4096, "top_consumer": "qos"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T11:22:26.013515Z", "process": "netconf", "pid": 4589, "crash_count_24h": 9, "last_crash_reason": "Memory corruption", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "process": "netconf", "pid": 4589, "crash_count_24h": 9, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T06:09:26.013007Z", "process": "crypto", "pid": 1109, "crash_count_24h": 5, "last_crash_reason": "Memory corruption", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "crypto", "pid": 1109, "crash_count_24h": 5, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:43:26.015358Z", "process": "bgp", "pid": 2351, "crash_count_24h": 17, "last_crash_reason": "Segmentation fault", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "process": "bgp", "pid": 2351, "crash_count_24h": 17, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T10:55:26.009452Z", "memory_used_percent": 98, "memory_free_mb": 143, "memory_total_mb": 1024, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 98, "memory_free_mb": 143, "memory_total_mb": 1024, "top_consumer": "crypto"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T10:48:26.004400Z", "cpu_5s_percent": 100, "cpu_1m_percent": 88, "cpu_5m_percent": 82, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 100, "cpu_1m_percent": 88, "cpu_5m_percent": 82, "top_process": "QoS Stats"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T03:31:26.006417Z", "cpu_5s_percent": 95, "cpu_1m_percent": 96, "cpu_5m_percent": 69, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "cpu_5s_percent": 95, "cpu_1m_percent": 96, "cpu_5m_percent": 69, "top_process": "BGP Scanner"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T03:43:26.014293Z", "process": "telemetry", "pid": 819, "crash_count_24h": 3, "last_crash_reason": "Memory corruption", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "process": "telemetry", "pid": 819, "crash_count_24h": 3, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T02:37:26.004155Z", "cpu_5s_percent": 96, "cpu_1m_percent": 87, "cpu_5m_percent": 88, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 96, "cpu_1m_percent": 87, "cpu_5m_percent": 88, "top_process": "ARP Input"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T01:31:26.010562Z", "memory_used_percent": 98, "memory_free_mb": 466, "memory_total_mb": 2048, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 98, "memory_free_mb": 466, "memory_total_mb": 2048, "top_consumer": "telemetry"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T10:27:26.008614Z", "memory_used_percent": 94, "memory_free_mb": 137, "memory_total_mb": 2048, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 94, "memory_free_mb": 137, "memory_total_mb": 2048, "top_consumer": "qos"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T06:43:26.013944Z", "process": "netconf", "pid": 2662, "crash_count_24h": 18, "last_crash_reason": "Segmentation fault", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "process": "netconf", "pid": 2662, "crash_count_24h": 18, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:50:26.013256Z", "process": "snmpd", "pid": 469, "crash_count_24h": 18, "last_crash_reason": "Unhandled exception", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "process": "snmpd", "pid": 469, "crash_count_24h": 18, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T01:48:26.014765Z", "process": "ospf", "pid": 2208, "crash_count_24h": 19, "last_crash_reason": "Memory corruption", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "ospf", "pid": 2208, "crash_count_24h": 19, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T06:32:26.017165Z", "process": "telemetry", "pid": 4249, "crash_count_24h": 11, "last_crash_reason": "Unhandled exception", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 4249, "crash_count_24h": 11, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T02:55:26.012224Z", "memory_used_percent": 95, "memory_free_mb": 137, "memory_total_mb": 1024, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "memory_used_percent": 95, "memory_free_mb": 137, "memory_total_mb": 1024, "top_consumer": "crypto"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T06:13:26.009734Z", "memory_used_percent": 99, "memory_free_mb": 324, "memory_total_mb": 2048, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "memory_used_percent": 99, "memory_free_mb": 324, "memory_total_mb": 2048, "top_consumer": "qos"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:44:26.005405Z", "cpu_5s_percent": 91, "cpu_1m_percent": 88, "cpu_5m_percent": 76, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 91, "cpu_1m_percent": 88, "cpu_5m_percent": 76, "top_process": "Net Background"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T10:15:26.015367Z", "process": "bgp", "pid": 1450, "crash_count_24h": 17, "last_crash_reason": "Watchdog timeout", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "process": "bgp", "pid": 1450, "crash_count_24h": 17, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:08:26.005580Z", "cpu_5s_percent": 85, "cpu_1m_percent": 90, "cpu_5m_percent": 90, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 85, "cpu_1m_percent": 90, "cpu_5m_percent": 90, "top_process": "OSPF-1 Router"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T06:29:26.011385Z", "memory_used_percent": 98, "memory_free_mb": 306, "memory_total_mb": 1024, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "memory_used_percent": 98, "memory_free_mb": 306, "memory_total_mb": 1024, "top_consumer": "telemetry"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:15:26.005797Z", "cpu_5s_percent": 89, "cpu_1m_percent": 92, "cpu_5m_percent": 72, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 89, "cpu_1m_percent": 92, "cpu_5m_percent": 72, "top_process": "BGP Scanner"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:24:26.006126Z", "cpu_5s_percent": 90, "cpu_1m_percent": 90, "cpu_5m_percent": 82, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 90, "cpu_1m_percent": 90, "cpu_5m_percent": 82, "top_process": "ARP Input"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T04:49:26.010089Z", "memory_used_percent": 95, "memory_free_mb": 500, "memory_total_mb": 2048, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "memory_used_percent": 95, "memory_free_mb": 500, "memory_total_mb": 2048, "top_consumer": "qos"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T09:57:26.014331Z", "process": "iosd", "pid": 1392, "crash_count_24h": 24, "last_crash_reason": "Watchdog timeout", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "process": "iosd", "pid": 1392, "crash_count_24h": 24, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T10:25:26.011527Z", "memory_used_percent": 99, "memory_free_mb": 445, "memory_total_mb": 4096, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "memory_used_percent": 99, "memory_free_mb": 445, "memory_total_mb": 4096, "top_consumer": "netconf"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T09:22:26.013549Z", "process": "snmpd", "pid": 4457, "crash_count_24h": 19, "last_crash_reason": "Watchdog timeout", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 4457, "crash_count_24h": 19, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:36:26.009494Z", "memory_used_percent": 92, "memory_free_mb": 328, "memory_total_mb": 2048, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "memory_used_percent": 92, "memory_free_mb": 328, "memory_total_mb": 2048, "top_consumer": "qos"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T02:44:26.009635Z", "memory_used_percent": 81, "memory_free_mb": 156, "memory_total_mb": 2048, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "memory_used_percent": 81, "memory_free_mb": 156, "memory_total_mb": 2048, "top_consumer": "bgp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T04:33:26.005590Z", "cpu_5s_percent": 93, "cpu_1m_percent": 91, "cpu_5m_percent": 91, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 93, "cpu_1m_percent": 91, "cpu_5m_percent": 91, "top_process": "ARP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:56:26.012938Z", "process": "telemetry", "pid": 1382, "crash_count_24h": 18, "last_crash_reason": "Watchdog timeout", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "telemetry", "pid": 1382, "crash_count_24h": 18, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:17:26.012314Z", "memory_used_percent": 92, "memory_free_mb": 349, "memory_total_mb": 4096, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 92, "memory_free_mb": 349, "memory_total_mb": 4096, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:10:26.009433Z", "memory_used_percent": 93, "memory_free_mb": 470, "memory_total_mb": 1024, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 93, "memory_free_mb": 470, "memory_total_mb": 1024, "top_consumer": "telemetry"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T10:56:26.011882Z", "memory_used_percent": 89, "memory_free_mb": 235, "memory_total_mb": 8192, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 89, "memory_free_mb": 235, "memory_total_mb": 8192, "top_consumer": "bgp"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T01:42:26.006153Z", "cpu_5s_percent": 100, "cpu_1m_percent": 95, "cpu_5m_percent": 78, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "cpu_5s_percent": 100, "cpu_1m_percent": 95, "cpu_5m_percent": 78, "top_process": "BGP Scanner"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T10:21:26.007402Z", "cpu_5s_percent": 96, "cpu_1m_percent": 76, "cpu_5m_percent": 77, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 96, "cpu_1m_percent": 76, "cpu_5m_percent": 77, "top_process": "SSH Process"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T10:16:26.013854Z", "process": "telemetry", "pid": 2154, "crash_count_24h": 3, "last_crash_reason": "Segmentation fault", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 2154, "crash_count_24h": 3, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:55:26.009209Z", "memory_used_percent": 93, "memory_free_mb": 478, "memory_total_mb": 1024, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 93, "memory_free_mb": 478, "memory_total_mb": 1024, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:58:26.009585Z", "memory_used_percent": 80, "memory_free_mb": 66, "memory_total_mb": 1024, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 80, "memory_free_mb": 66, "memory_total_mb": 1024, "top_consumer": "logging"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T07:56:26.009786Z", "memory_used_percent": 96, "memory_free_mb": 190, "memory_total_mb": 2048, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 96, "memory_free_mb": 190, "memory_total_mb": 2048, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T11:18:26.007798Z", "cpu_5s_percent": 98, "cpu_1m_percent": 87, "cpu_5m_percent": 86, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 98, "cpu_1m_percent": 87, "cpu_5m_percent": 86, "top_process": "OSPF-1 Router"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T02:18:26.015662Z", "process": "bgp", "pid": 1965, "crash_count_24h": 8, "last_crash_reason": "Watchdog timeout", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "process": "bgp", "pid": 1965, "crash_count_24h": 8, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T08:36:26.015328Z", "process": "ospf", "pid": 1399, "crash_count_24h": 23, "last_crash_reason": "Memory corruption", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "ospf", "pid": 1399, "crash_count_24h": 23, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:34:26.006047Z", "cpu_5s_percent": 90, "cpu_1m_percent": 80, "cpu_5m_percent": 72, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 90, "cpu_1m_percent": 80, "cpu_5m_percent": 72, "top_process": "Net Background"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:57:26.015421Z", "process": "netconf", "pid": 610, "crash_count_24h": 12, "last_crash_reason": "Memory corruption", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "netconf", "pid": 610, "crash_count_24h": 12, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:34:26.005475Z", "cpu_5s_percent": 85, "cpu_1m_percent": 99, "cpu_5m_percent": 71, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 85, "cpu_1m_percent": 99, "cpu_5m_percent": 71, "top_process": "ARP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:27:26.016367Z", "process": "ospf", "pid": 1334, "crash_count_24h": 5, "last_crash_reason": "Memory corruption", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "ospf", "pid": 1334, "crash_count_24h": 5, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T02:46:26.004475Z", "cpu_5s_percent": 89, "cpu_1m_percent": 94, "cpu_5m_percent": 93, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "cpu_5s_percent": 89, "cpu_1m_percent": 94, "cpu_5m_percent": 93, "top_process": "Net Background"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:20:26.006811Z", "cpu_5s_percent": 91, "cpu_1m_percent": 81, "cpu_5m_percent": 89, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 91, "cpu_1m_percent": 81, "cpu_5m_percent": 89, "top_process": "ARP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T04:17:26.015130Z", "process": "bgp", "pid": 2458, "crash_count_24h": 7, "last_crash_reason": "Segmentation fault", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "process": "bgp", "pid": 2458, "crash_count_24h": 7, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T04:27:26.011803Z", "memory_used_percent": 98, "memory_free_mb": 280, "memory_total_mb": 8192, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 98, "memory_free_mb": 280, "memory_total_mb": 8192, "top_consumer": "bgp"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T02:08:26.012362Z", "memory_used_percent": 93, "memory_free_mb": 218, "memory_total_mb": 2048, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 93, "memory_free_mb": 218, "memory_total_mb": 2048, "top_consumer": "telemetry"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T06:42:26.007053Z", "cpu_5s_percent": 94, "cpu_1m_percent": 80, "cpu_5m_percent": 83, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 94, "cpu_1m_percent": 80, "cpu_5m_percent": 83, "top_process": "IP Input"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T06:10:26.014011Z", "process": "crypto", "pid": 286, "crash_count_24h": 4, "last_crash_reason": "Watchdog timeout", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "crypto", "pid": 286, "crash_count_24h": 4, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:18:26.004765Z", "cpu_5s_percent": 93, "cpu_1m_percent": 87, "cpu_5m_percent": 74, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 93, "cpu_1m_percent": 87, "cpu_5m_percent": 74, "top_process": "ARP Input"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:26:26.016489Z", "process": "crypto", "pid": 3465, "crash_count_24h": 10, "last_crash_reason": "Segmentation fault", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "crypto", "pid": 3465, "crash_count_24h": 10, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T04:39:26.009714Z", "memory_used_percent": 85, "memory_free_mb": 397, "memory_total_mb": 1024, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 85, "memory_free_mb": 397, "memory_total_mb": 1024, "top_consumer": "snmp"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T05:52:26.012805Z", "process": "ospf", "pid": 2696, "crash_count_24h": 25, "last_crash_reason": "Watchdog timeout", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "ospf", "pid": 2696, "crash_count_24h": 25, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T06:21:26.011617Z", "memory_used_percent": 94, "memory_free_mb": 143, "memory_total_mb": 4096, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 94, "memory_free_mb": 143, "memory_total_mb": 4096, "top_consumer": "cef"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:14:26.012989Z", "process": "crypto", "pid": 2870, "crash_count_24h": 15, "last_crash_reason": "Unhandled exception", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "crypto", "pid": 2870, "crash_count_24h": 15, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T04:17:26.004625Z", "cpu_5s_percent": 99, "cpu_1m_percent": 90, "cpu_5m_percent": 89, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 99, "cpu_1m_percent": 90, "cpu_5m_percent": 89, "top_process": "Crypto IKEv2"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T10:05:26.008133Z", "cpu_5s_percent": 95, "cpu_1m_percent": 82, "cpu_5m_percent": 93, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 95, "cpu_1m_percent": 82, "cpu_5m_percent": 93, "top_process": "Crypto IKEv2"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T10:15:26.005996Z", "cpu_5s_percent": 87, "cpu_1m_percent": 80, "cpu_5m_percent": 85, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 87, "cpu_1m_percent": 80, "cpu_5m_percent": 85, "top_process": "Crypto IKEv2"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T06:05:26.014148Z", "process": "snmpd", "pid": 119, "crash_count_24h": 17, "last_crash_reason": "Unhandled exception", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 119, "crash_count_24h": 17, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:20:26.011818Z", "memory_used_percent": 94, "memory_free_mb": 409, "memory_total_mb": 2048, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 94, "memory_free_mb": 409, "memory_total_mb": 2048, "top_consumer": "logging"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T10:50:26.015790Z", "process": "ospf", "pid": 974, "crash_count_24h": 22, "last_crash_reason": "Memory corruption", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "process": "ospf", "pid": 974, "crash_count_24h": 22, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T04:11:26.004874Z", "cpu_5s_percent": 97, "cpu_1m_percent": 82, "cpu_5m_percent": 89, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 97, "cpu_1m_percent": 82, "cpu_5m_percent": 89, "top_process": "CEF RP"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T08:29:26.011079Z", "memory_used_percent": 96, "memory_free_mb": 336, "memory_total_mb": 1024, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 96, "memory_free_mb": 336, "memory_total_mb": 1024, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T07:23:26.015535Z", "process": "telemetry", "pid": 4475, "crash_count_24h": 3, "last_crash_reason": "Unhandled exception", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "telemetry", "pid": 4475, "crash_count_24h": 3, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:39:26.014090Z", "process": "bgp", "pid": 1300, "crash_count_24h": 9, "last_crash_reason": "Watchdog timeout", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "bgp", "pid": 1300, "crash_count_24h": 9, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T02:37:26.013885Z", "process": "iosd", "pid": 2216, "crash_count_24h": 24, "last_crash_reason": "Watchdog timeout", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "iosd", "pid": 2216, "crash_count_24h": 24, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T09:08:26.006851Z", "cpu_5s_percent": 95, "cpu_1m_percent": 84, "cpu_5m_percent": 74, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 95, "cpu_1m_percent": 84, "cpu_5m_percent": 74, "top_process": "Net Background"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:04:26.014021Z", "process": "ospf", "pid": 3645, "crash_count_24h": 3, "last_crash_reason": "Segmentation fault", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "ospf", "pid": 3645, "crash_count_24h": 3, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T06:53:26.012571Z", "process": "crypto", "pid": 4008, "crash_count_24h": 3, "last_crash_reason": "Unhandled exception", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "crypto", "pid": 4008, "crash_count_24h": 3, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T02:13:26.008861Z", "memory_used_percent": 86, "memory_free_mb": 483, "memory_total_mb": 4096, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "memory_used_percent": 86, "memory_free_mb": 483, "memory_total_mb": 4096, "top_consumer": "cef"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T11:04:26.007092Z", "cpu_5s_percent": 85, "cpu_1m_percent": 90, "cpu_5m_percent": 66, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 85, "cpu_1m_percent": 90, "cpu_5m_percent": 66, "top_process": "IP Input"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T06:01:26.007249Z", "cpu_5s_percent": 93, "cpu_1m_percent": 92, "cpu_5m_percent": 93, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 93, "cpu_1m_percent": 92, "cpu_5m_percent": 93, "top_process": "ARP Input"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T09:44:26.013710Z", "process": "crypto", "pid": 1113, "crash_count_24h": 17, "last_crash_reason": "Segmentation fault", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "crypto", "pid": 1113, "crash_count_24h": 17, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T10:49:26.004260Z", "cpu_5s_percent": 94, "cpu_1m_percent": 83, "cpu_5m_percent": 65, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 94, "cpu_1m_percent": 83, "cpu_5m_percent": 65, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T11:10:26.010881Z", "memory_used_percent": 82, "memory_free_mb": 415, "memory_total_mb": 2048, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 82, "memory_free_mb": 415, "memory_total_mb": 2048, "top_consumer": "logging"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T10:48:26.008870Z", "memory_used_percent": 84, "memory_free_mb": 254, "memory_total_mb": 4096, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "memory_used_percent": 84, "memory_free_mb": 254, "memory_total_mb": 4096, "top_consumer": "netconf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:30:26.006074Z", "cpu_5s_percent": 93, "cpu_1m_percent": 95, "cpu_5m_percent": 85, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 93, "cpu_1m_percent": 95, "cpu_5m_percent": 85, "top_process": "CEF RP"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T07:37:26.007760Z", "cpu_5s_percent": 95, "cpu_1m_percent": 88, "cpu_5m_percent": 73, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 95, "cpu_1m_percent": 88, "cpu_5m_percent": 73, "top_process": "IP Input"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:23:26.007561Z", "cpu_5s_percent": 85, "cpu_1m_percent": 79, "cpu_5m_percent": 70, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "cpu_5s_percent": 85, "cpu_1m_percent": 79, "cpu_5m_percent": 70, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T06:11:26.009070Z", "memory_used_percent": 99, "memory_free_mb": 243, "memory_total_mb": 8192, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "memory_used_percent": 99, "memory_free_mb": 243, "memory_total_mb": 8192, "top_consumer": "ospf"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:07:26.010545Z", "memory_used_percent": 84, "memory_free_mb": 420, "memory_total_mb": 8192, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 84, "memory_free_mb": 420, "memory_total_mb": 8192, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:51:26.014110Z", "process": "crypto", "pid": 2833, "crash_count_24h": 20, "last_crash_reason": "Watchdog timeout", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "process": "crypto", "pid": 2833, "crash_count_24h": 20, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T08:05:26.014061Z", "process": "ospf", "pid": 4363, "crash_count_24h": 25, "last_crash_reason": "Memory corruption", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "process": "ospf", "pid": 4363, "crash_count_24h": 25, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T07:41:26.013845Z", "process": "ospf", "pid": 3060, "crash_count_24h": 7, "last_crash_reason": "Unhandled exception", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "ospf", "pid": 3060, "crash_count_24h": 7, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:08:26.009838Z", "memory_used_percent": 83, "memory_free_mb": 434, "memory_total_mb": 8192, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 83, "memory_free_mb": 434, "memory_total_mb": 8192, "top_consumer": "logging"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T05:02:26.015098Z", "process": "snmpd", "pid": 2176, "crash_count_24h": 8, "last_crash_reason": "Watchdog timeout", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "snmpd", "pid": 2176, "crash_count_24h": 8, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T05:42:26.007826Z", "cpu_5s_percent": 99, "cpu_1m_percent": 88, "cpu_5m_percent": 83, "top_process": "IP Input", "description": "CPU utilization exceeded threshold. Top consumer: IP Input."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "cpu_5s_percent": 99, "cpu_1m_percent": 88, "cpu_5m_percent": 83, "top_process": "IP Input"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T10:00:26.012763Z", "process": "snmpd", "pid": 648, "crash_count_24h": 19, "last_crash_reason": "Watchdog timeout", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 648, "crash_count_24h": 19, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T09:06:26.010070Z", "memory_used_percent": 97, "memory_free_mb": 428, "memory_total_mb": 2048, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 97, "memory_free_mb": 428, "memory_total_mb": 2048, "top_consumer": "netconf"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:30:26.009704Z", "memory_used_percent": 83, "memory_free_mb": 411, "memory_total_mb": 4096, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "memory_used_percent": 83, "memory_free_mb": 411, "memory_total_mb": 4096, "top_consumer": "ospf"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T06:15:26.011158Z", "memory_used_percent": 85, "memory_free_mb": 488, "memory_total_mb": 1024, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 85, "memory_free_mb": 488, "memory_total_mb": 1024, "top_consumer": "bgp"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T01:55:26.009482Z", "memory_used_percent": 88, "memory_free_mb": 150, "memory_total_mb": 4096, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "memory_used_percent": 88, "memory_free_mb": 150, "memory_total_mb": 4096, "top_consumer": "telemetry"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T07:47:26.014001Z", "process": "crypto", "pid": 802, "crash_count_24h": 4, "last_crash_reason": "Segmentation fault", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "crypto", "pid": 802, "crash_count_24h": 4, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T10:44:26.004918Z", "cpu_5s_percent": 87, "cpu_1m_percent": 80, "cpu_5m_percent": 82, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 87, "cpu_1m_percent": 80, "cpu_5m_percent": 82, "top_process": "OSPF-1 Router"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T06:55:26.010303Z", "memory_used_percent": 81, "memory_free_mb": 289, "memory_total_mb": 4096, "top_consumer": "snmp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: snmp."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "memory_used_percent": 81, "memory_free_mb": 289, "memory_total_mb": 4096, "top_consumer": "snmp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T03:19:26.011117Z", "memory_used_percent": 95, "memory_free_mb": 473, "memory_total_mb": 2048, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 95, "memory_free_mb": 473, "memory_total_mb": 2048, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:13:26.010420Z", "memory_used_percent": 84, "memory_free_mb": 211, "memory_total_mb": 1024, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 84, "memory_free_mb": 211, "memory_total_mb": 1024, "top_consumer": "bgp"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T01:28:26.014953Z", "process": "iosd", "pid": 1539, "crash_count_24h": 11, "last_crash_reason": "Segmentation fault", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "iosd", "pid": 1539, "crash_count_24h": 11, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T02:04:26.006467Z", "cpu_5s_percent": 87, "cpu_1m_percent": 83, "cpu_5m_percent": 87, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 87, "cpu_1m_percent": 83, "cpu_5m_percent": 87, "top_process": "CEF RP"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:03:26.009001Z", "memory_used_percent": 85, "memory_free_mb": 257, "memory_total_mb": 1024, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "memory_used_percent": 85, "memory_free_mb": 257, "memory_total_mb": 1024, "top_consumer": "netconf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T10:00:26.015122Z", "process": "ospf", "pid": 4065, "crash_count_24h": 11, "last_crash_reason": "Memory corruption", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "ospf", "pid": 4065, "crash_count_24h": 11, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T06:09:26.011107Z", "memory_used_percent": 87, "memory_free_mb": 76, "memory_total_mb": 4096, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 87, "memory_free_mb": 76, "memory_total_mb": 4096, "top_consumer": "qos"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T04:56:26.014837Z", "process": "telemetry", "pid": 3068, "crash_count_24h": 19, "last_crash_reason": "Unhandled exception", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 3068, "crash_count_24h": 19, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T08:16:26.016025Z", "process": "netconf", "pid": 1464, "crash_count_24h": 5, "last_crash_reason": "Segmentation fault", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "netconf", "pid": 1464, "crash_count_24h": 5, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:56:26.013506Z", "process": "iosd", "pid": 2484, "crash_count_24h": 2, "last_crash_reason": "Memory corruption", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios", "process": "iosd", "pid": 2484, "crash_count_24h": 2, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T06:18:26.009400Z", "memory_used_percent": 99, "memory_free_mb": 448, "memory_total_mb": 8192, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "memory_used_percent": 99, "memory_free_mb": 448, "memory_total_mb": 8192, "top_consumer": "netconf"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T06:01:26.004142Z", "cpu_5s_percent": 85, "cpu_1m_percent": 96, "cpu_5m_percent": 80, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 85, "cpu_1m_percent": 96, "cpu_5m_percent": 80, "top_process": "Net Background"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T01:40:26.007836Z", "cpu_5s_percent": 88, "cpu_1m_percent": 75, "cpu_5m_percent": 65, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 88, "cpu_1m_percent": 75, "cpu_5m_percent": 65, "top_process": "BGP Scanner"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:27:26.006790Z", "cpu_5s_percent": 87, "cpu_1m_percent": 97, "cpu_5m_percent": 72, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 87, "cpu_1m_percent": 97, "cpu_5m_percent": 72, "top_process": "QoS Stats"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T08:32:26.014604Z", "process": "crypto", "pid": 1077, "crash_count_24h": 12, "last_crash_reason": "Unhandled exception", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "process": "crypto", "pid": 1077, "crash_count_24h": 12, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T09:54:26.013992Z", "process": "telemetry", "pid": 1606, "crash_count_24h": 18, "last_crash_reason": "Unhandled exception", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 1606, "crash_count_24h": 18, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T02:39:26.007453Z", "cpu_5s_percent": 97, "cpu_1m_percent": 97, "cpu_5m_percent": 66, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 97, "cpu_1m_percent": 97, "cpu_5m_percent": 66, "top_process": "Net Background"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T07:12:26.011188Z", "memory_used_percent": 96, "memory_free_mb": 324, "memory_total_mb": 2048, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 96, "memory_free_mb": 324, "memory_total_mb": 2048, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T11:18:26.010973Z", "memory_used_percent": 92, "memory_free_mb": 221, "memory_total_mb": 2048, "top_consumer": "crypto", "description": "Memory utilization exceeded threshold. Top consumer subsystem: crypto."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 92, "memory_free_mb": 221, "memory_total_mb": 2048, "top_consumer": "crypto"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T01:30:26.009645Z", "memory_used_percent": 83, "memory_free_mb": 242, "memory_total_mb": 2048, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 83, "memory_free_mb": 242, "memory_total_mb": 2048, "top_consumer": "telemetry"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T07:57:26.009178Z", "memory_used_percent": 80, "memory_free_mb": 289, "memory_total_mb": 4096, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 80, "memory_free_mb": 289, "memory_total_mb": 4096, "top_consumer": "netconf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T02:43:26.004486Z", "cpu_5s_percent": 89, "cpu_1m_percent": 93, "cpu_5m_percent": 74, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 89, "cpu_1m_percent": 93, "cpu_5m_percent": 74, "top_process": "OSPF-1 Router"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:07:26.006967Z", "cpu_5s_percent": 90, "cpu_1m_percent": 87, "cpu_5m_percent": 93, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 90, "cpu_1m_percent": 87, "cpu_5m_percent": 93, "top_process": "ARP Input"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T02:19:26.010755Z", "memory_used_percent": 92, "memory_free_mb": 224, "memory_total_mb": 2048, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 92, "memory_free_mb": 224, "memory_total_mb": 2048, "top_consumer": "telemetry"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:08:26.005651Z", "cpu_5s_percent": 89, "cpu_1m_percent": 98, "cpu_5m_percent": 69, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 89, "cpu_1m_percent": 98, "cpu_5m_percent": 69, "top_process": "OSPF-1 Router"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T09:00:26.015881Z", "process": "bgp", "pid": 2666, "crash_count_24h": 12, "last_crash_reason": "Segmentation fault", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "bgp", "pid": 2666, "crash_count_24h": 12, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T04:24:26.012880Z", "process": "netconf", "pid": 1050, "crash_count_24h": 5, "last_crash_reason": "Memory corruption", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "netconf", "pid": 1050, "crash_count_24h": 5, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T08:52:26.006740Z", "cpu_5s_percent": 99, "cpu_1m_percent": 95, "cpu_5m_percent": 85, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 99, "cpu_1m_percent": 95, "cpu_5m_percent": 85, "top_process": "Net Background"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:34:26.004687Z", "cpu_5s_percent": 90, "cpu_1m_percent": 95, "cpu_5m_percent": 85, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "cpu_5s_percent": 90, "cpu_1m_percent": 95, "cpu_5m_percent": 85, "top_process": "ARP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T04:57:26.006601Z", "cpu_5s_percent": 98, "cpu_1m_percent": 94, "cpu_5m_percent": 79, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 98, "cpu_1m_percent": 94, "cpu_5m_percent": 79, "top_process": "CEF RP"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T10:00:26.004123Z", "cpu_5s_percent": 99, "cpu_1m_percent": 82, "cpu_5m_percent": 65, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 99, "cpu_1m_percent": 82, "cpu_5m_percent": 65, "top_process": "SSH Process"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:37:26.006759Z", "cpu_5s_percent": 94, "cpu_1m_percent": 75, "cpu_5m_percent": 93, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 94, "cpu_1m_percent": 75, "cpu_5m_percent": 93, "top_process": "OSPF-1 Router"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T04:11:26.012185Z", "memory_used_percent": 93, "memory_free_mb": 436, "memory_total_mb": 2048, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 93, "memory_free_mb": 436, "memory_total_mb": 2048, "top_consumer": "bgp"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T01:47:26.005960Z", "cpu_5s_percent": 90, "cpu_1m_percent": 76, "cpu_5m_percent": 71, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 90, "cpu_1m_percent": 76, "cpu_5m_percent": 71, "top_process": "Crypto IKEv2"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T01:54:26.014030Z", "process": "netconf", "pid": 3990, "crash_count_24h": 16, "last_crash_reason": "Watchdog timeout", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios_xe", "process": "netconf", "pid": 3990, "crash_count_24h": 16, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T02:25:26.004189Z", "cpu_5s_percent": 100, "cpu_1m_percent": 87, "cpu_5m_percent": 94, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 100, "cpu_1m_percent": 87, "cpu_5m_percent": 94, "top_process": "QoS Stats"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T09:05:26.014715Z", "process": "snmpd", "pid": 3764, "crash_count_24h": 6, "last_crash_reason": "Memory corruption", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "process": "snmpd", "pid": 3764, "crash_count_24h": 6, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T06:18:26.006263Z", "cpu_5s_percent": 99, "cpu_1m_percent": 99, "cpu_5m_percent": 79, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "cpu_5s_percent": 99, "cpu_1m_percent": 99, "cpu_5m_percent": 79, "top_process": "Crypto IKEv2"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T02:59:26.014657Z", "process": "crypto", "pid": 4843, "crash_count_24h": 20, "last_crash_reason": "Unhandled exception", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "process": "crypto", "pid": 4843, "crash_count_24h": 20, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:42:26.016447Z", "process": "ospf", "pid": 2876, "crash_count_24h": 14, "last_crash_reason": "Memory corruption", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "process": "ospf", "pid": 2876, "crash_count_24h": 14, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:35:26.008581Z", "memory_used_percent": 81, "memory_free_mb": 326, "memory_total_mb": 8192, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "memory_used_percent": 81, "memory_free_mb": 326, "memory_total_mb": 8192, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:31:26.015728Z", "process": "ospf", "pid": 396, "crash_count_24h": 21, "last_crash_reason": "Segmentation fault", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "ospf", "pid": 396, "crash_count_24h": 21, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T02:46:26.009535Z", "memory_used_percent": 81, "memory_free_mb": 404, "memory_total_mb": 1024, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "memory_used_percent": 81, "memory_free_mb": 404, "memory_total_mb": 1024, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "logging buffered 8192 warnings", "no logging console"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T02:08:26.016172Z", "process": "telemetry", "pid": 380, "crash_count_24h": 9, "last_crash_reason": "Watchdog timeout", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 380, "crash_count_24h": 9, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T04:59:26.009849Z", "memory_used_percent": 98, "memory_free_mb": 497, "memory_total_mb": 1024, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 98, "memory_free_mb": 497, "memory_total_mb": 1024, "top_consumer": "netconf"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T09:39:26.014878Z", "process": "netconf", "pid": 3538, "crash_count_24h": 15, "last_crash_reason": "Watchdog timeout", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "process": "netconf", "pid": 3538, "crash_count_24h": 15, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:23:26.013417Z", "process": "telemetry", "pid": 4153, "crash_count_24h": 24, "last_crash_reason": "Segmentation fault", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 4153, "crash_count_24h": 24, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T07:17:26.015488Z", "process": "netconf", "pid": 2106, "crash_count_24h": 4, "last_crash_reason": "Watchdog timeout", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "process": "netconf", "pid": 2106, "crash_count_24h": 4, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T10:56:26.004512Z", "cpu_5s_percent": 96, "cpu_1m_percent": 99, "cpu_5m_percent": 95, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "cpu_5s_percent": 96, "cpu_1m_percent": 99, "cpu_5m_percent": 95, "top_process": "ARP Input"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T05:17:26.014489Z", "process": "telemetry", "pid": 3048, "crash_count_24h": 3, "last_crash_reason": "Memory corruption", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 3048, "crash_count_24h": 3, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T06:05:26.010871Z", "memory_used_percent": 99, "memory_free_mb": 348, "memory_total_mb": 1024, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 99, "memory_free_mb": 348, "memory_total_mb": 1024, "top_consumer": "cef"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T08:34:26.014737Z", "process": "crypto", "pid": 678, "crash_count_24h": 4, "last_crash_reason": "Unhandled exception", "description": "Process 'crypto' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "process": "crypto", "pid": 678, "crash_count_24h": 4, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T10:51:26.010284Z", "memory_used_percent": 96, "memory_free_mb": 112, "memory_total_mb": 1024, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 96, "memory_free_mb": 112, "memory_total_mb": 1024, "top_consumer": "logging"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T06:02:26.012304Z", "memory_used_percent": 91, "memory_free_mb": 125, "memory_total_mb": 8192, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 91, "memory_free_mb": 125, "memory_total_mb": 8192, "top_consumer": "telemetry"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:38:26.004553Z", "cpu_5s_percent": 91, "cpu_1m_percent": 88, "cpu_5m_percent": 84, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 91, "cpu_1m_percent": 88, "cpu_5m_percent": 84, "top_process": "OSPF-1 Router"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T07:46:26.013561Z", "process": "snmpd", "pid": 3961, "crash_count_24h": 10, "last_crash_reason": "Watchdog timeout", "description": "Process 'snmpd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "process": "snmpd", "pid": 3961, "crash_count_24h": 10, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T10:51:26.014547Z", "process": "telemetry", "pid": 3305, "crash_count_24h": 6, "last_crash_reason": "Segmentation fault", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "process": "telemetry", "pid": 3305, "crash_count_24h": 6, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T04:51:26.008144Z", "cpu_5s_percent": 92, "cpu_1m_percent": 81, "cpu_5m_percent": 85, "top_process": "Net Background", "description": "CPU utilization exceeded threshold. Top consumer: Net Background."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "cpu_5s_percent": 92, "cpu_1m_percent": 81, "cpu_5m_percent": 85, "top_process": "Net Background"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T02:45:26.010796Z", "memory_used_percent": 96, "memory_free_mb": 124, "memory_total_mb": 2048, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "memory_used_percent": 96, "memory_free_mb": 124, "memory_total_mb": 2048, "top_consumer": "logging"}], "cli_fix": ["logging buffered 8192 warnings", "logging persistent size 4096", "no logging console"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:12:26.004595Z", "cpu_5s_percent": 89, "cpu_1m_percent": 80, "cpu_5m_percent": 86, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 89, "cpu_1m_percent": 80, "cpu_5m_percent": 86, "top_process": "QoS Stats"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T10:44:26.005817Z", "cpu_5s_percent": 88, "cpu_1m_percent": 83, "cpu_5m_percent": 74, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "cpu_5s_percent": 88, "cpu_1m_percent": 83, "cpu_5m_percent": 74, "top_process": "QoS Stats"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:00:26.012174Z", "memory_used_percent": 88, "memory_free_mb": 107, "memory_total_mb": 1024, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 88, "memory_free_mb": 107, "memory_total_mb": 1024, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:24:26.014322Z", "process": "iosd", "pid": 3338, "crash_count_24h": 9, "last_crash_reason": "Segmentation fault", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios", "process": "iosd", "pid": 3338, "crash_count_24h": 9, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T02:09:26.008261Z", "cpu_5s_percent": 98, "cpu_1m_percent": 95, "cpu_5m_percent": 77, "top_process": "OSPF-1 Router", "description": "CPU utilization exceeded threshold. Top consumer: OSPF-1 Router."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 98, "cpu_1m_percent": 95, "cpu_5m_percent": 77, "top_process": "OSPF-1 Router"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T01:30:26.004840Z", "cpu_5s_percent": 94, "cpu_1m_percent": 75, "cpu_5m_percent": 78, "top_process": "SSH Process", "description": "CPU utilization exceeded threshold. Top consumer: SSH Process."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 94, "cpu_1m_percent": 75, "cpu_5m_percent": 78, "top_process": "SSH Process"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T06:22:26.011198Z", "memory_used_percent": 97, "memory_free_mb": 369, "memory_total_mb": 2048, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "memory_used_percent": 97, "memory_free_mb": 369, "memory_total_mb": 2048, "top_consumer": "bgp"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T04:56:26.012351Z", "memory_used_percent": 91, "memory_free_mb": 230, "memory_total_mb": 1024, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "memory_used_percent": 91, "memory_free_mb": 230, "memory_total_mb": 1024, "top_consumer": "logging"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T04:06:26.014925Z", "process": "iosd", "pid": 1671, "crash_count_24h": 25, "last_crash_reason": "Watchdog timeout", "description": "Process 'iosd' crashed/restarted multiple times. Last reason: Watchdog timeout."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "process": "iosd", "pid": 1671, "crash_count_24h": 25, "last_crash_reason": "Watchdog timeout"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T08:56:26.007868Z", "cpu_5s_percent": 90, "cpu_1m_percent": 90, "cpu_5m_percent": 81, "top_process": "Crypto IKEv2", "description": "CPU utilization exceeded threshold. Top consumer: Crypto IKEv2."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "cpu_5s_percent": 90, "cpu_1m_percent": 90, "cpu_5m_percent": 81, "top_process": "Crypto IKEv2"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T02:36:26.005679Z", "cpu_5s_percent": 85, "cpu_1m_percent": 84, "cpu_5m_percent": 72, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 85, "cpu_1m_percent": 84, "cpu_5m_percent": 72, "top_process": "QoS Stats"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T11:01:26.006924Z", "cpu_5s_percent": 87, "cpu_1m_percent": 95, "cpu_5m_percent": 85, "top_process": "CEF RP", "description": "CPU utilization exceeded threshold. Top consumer: CEF RP."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios_xe", "cpu_5s_percent": 87, "cpu_1m_percent": 95, "cpu_5m_percent": 85, "top_process": "CEF RP"}], "cli_fix": ["no service finger", "no ip bootp server", "no service config", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T05:55:26.011851Z", "memory_used_percent": 81, "memory_free_mb": 129, "memory_total_mb": 2048, "top_consumer": "telemetry", "description": "Memory utilization exceeded threshold. Top consumer subsystem: telemetry."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 81, "memory_free_mb": 129, "memory_total_mb": 2048, "top_consumer": "telemetry"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T06:24:26.011346Z", "memory_used_percent": 83, "memory_free_mb": 456, "memory_total_mb": 4096, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "memory_used_percent": 83, "memory_free_mb": 456, "memory_total_mb": 4096, "top_consumer": "cef"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T02:28:26.011227Z", "memory_used_percent": 98, "memory_free_mb": 83, "memory_total_mb": 4096, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 98, "memory_free_mb": 83, "memory_total_mb": 4096, "top_consumer": "cef"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T07:43:26.009963Z", "memory_used_percent": 81, "memory_free_mb": 471, "memory_total_mb": 2048, "top_consumer": "http", "description": "Memory utilization exceeded threshold. Top consumer subsystem: http."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "memory_used_percent": 81, "memory_free_mb": 471, "memory_total_mb": 2048, "top_consumer": "http"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no ip bootp server", "no service finger"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T10:26:26.011267Z", "memory_used_percent": 90, "memory_free_mb": 467, "memory_total_mb": 2048, "top_consumer": "ospf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: ospf."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 90, "memory_free_mb": 467, "memory_total_mb": 2048, "top_consumer": "ospf"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T08:40:26.015891Z", "process": "ospf", "pid": 1777, "crash_count_24h": 23, "last_crash_reason": "Segmentation fault", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "process": "ospf", "pid": 1777, "crash_count_24h": 23, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T11:06:26.007082Z", "cpu_5s_percent": 85, "cpu_1m_percent": 77, "cpu_5m_percent": 66, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios", "cpu_5s_percent": 85, "cpu_1m_percent": 77, "cpu_5m_percent": 66, "top_process": "QoS Stats"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T11:08:26.004431Z", "cpu_5s_percent": 98, "cpu_1m_percent": 79, "cpu_5m_percent": 79, "top_process": "SNMP ENGINE", "description": "CPU utilization exceeded threshold. Top consumer: SNMP ENGINE."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios", "cpu_5s_percent": 98, "cpu_1m_percent": 79, "cpu_5m_percent": 79, "top_process": "SNMP ENGINE"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T06:58:26.013765Z", "process": "ospf", "pid": 3395, "crash_count_24h": 13, "last_crash_reason": "Memory corruption", "description": "Process 'ospf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios", "process": "ospf", "pid": 3395, "crash_count_24h": 13, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging buffered 16384 warnings", "service timestamps debug datetime msec"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:38:26.011037Z", "memory_used_percent": 87, "memory_free_mb": 149, "memory_total_mb": 8192, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "DIST-SW1", "platform": "cisco_ios_xe", "memory_used_percent": 87, "memory_free_mb": 149, "memory_total_mb": 8192, "top_consumer": "cef"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T04:54:26.011641Z", "memory_used_percent": 95, "memory_free_mb": 247, "memory_total_mb": 1024, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 95, "memory_free_mb": 247, "memory_total_mb": 1024, "top_consumer": "netconf"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "EDGE-RTR1", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T10:55:26.014223Z", "process": "bgp", "pid": 1300, "crash_count_24h": 6, "last_crash_reason": "Segmentation fault", "description": "Process 'bgp' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "process": "bgp", "pid": 1300, "crash_count_24h": 6, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "BRANCH-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:47:26.005297Z", "cpu_5s_percent": 88, "cpu_1m_percent": 85, "cpu_5m_percent": 73, "top_process": "ARP Input", "description": "CPU utilization exceeded threshold. Top consumer: ARP Input."}, "devices": [{"name": "BRANCH-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 88, "cpu_1m_percent": 85, "cpu_5m_percent": 73, "top_process": "ARP Input"}], "cli_fix": ["snmp-server queue-length 5", "no snmp-server enable traps", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "EDGE-RTR1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T04:45:26.005074Z", "cpu_5s_percent": 94, "cpu_1m_percent": 86, "cpu_5m_percent": 69, "top_process": "QoS Stats", "description": "CPU utilization exceeded threshold. Top consumer: QoS Stats."}, "devices": [{"name": "EDGE-RTR1", "platform": "cisco_ios_xe", "cpu_5s_percent": 94, "cpu_1m_percent": 86, "cpu_5m_percent": 69, "top_process": "QoS Stats"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "CORE-R1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T11:06:26.012068Z", "memory_used_percent": 89, "memory_free_mb": 58, "memory_total_mb": 8192, "top_consumer": "netconf", "description": "Memory utilization exceeded threshold. Top consumer subsystem: netconf."}, "devices": [{"name": "CORE-R1", "platform": "cisco_ios_xe", "memory_used_percent": 89, "memory_free_mb": 58, "memory_total_mb": 8192, "top_consumer": "netconf"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T06:51:26.013864Z", "process": "telemetry", "pid": 1483, "crash_count_24h": 20, "last_crash_reason": "Memory corruption", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 1483, "crash_count_24h": 20, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T01:44:26.016090Z", "process": "netconf", "pid": 1139, "crash_count_24h": 10, "last_crash_reason": "Segmentation fault", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Segmentation fault."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "process": "netconf", "pid": 1139, "crash_count_24h": 10, "last_crash_reason": "Segmentation fault"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "DC-SW2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T10:11:26.017174Z", "process": "netconf", "pid": 2425, "crash_count_24h": 13, "last_crash_reason": "Unhandled exception", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "DC-SW2", "platform": "cisco_ios", "process": "netconf", "pid": 2425, "crash_count_24h": 13, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:56:26.004677Z", "cpu_5s_percent": 93, "cpu_1m_percent": 78, "cpu_5m_percent": 95, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "cpu_5s_percent": 93, "cpu_1m_percent": 78, "cpu_5m_percent": 95, "top_process": "BGP Scanner"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T04:37:26.012108Z", "memory_used_percent": 82, "memory_free_mb": 126, "memory_total_mb": 1024, "top_consumer": "qos", "description": "Memory utilization exceeded threshold. Top consumer subsystem: qos."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "memory_used_percent": 82, "memory_free_mb": 126, "memory_total_mb": 1024, "top_consumer": "qos"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "DC-SW1", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:19:26.008802Z", "memory_used_percent": 91, "memory_free_mb": 432, "memory_total_mb": 1024, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "DC-SW1", "platform": "cisco_ios", "memory_used_percent": 91, "memory_free_mb": 432, "memory_total_mb": 1024, "top_consumer": "logging"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T08:26:26.015395Z", "process": "netconf", "pid": 960, "crash_count_24h": 5, "last_crash_reason": "Memory corruption", "description": "Process 'netconf' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "netconf", "pid": 960, "crash_count_24h": 5, "last_crash_reason": "Memory corruption"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "EDGE-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T06:09:26.010860Z", "memory_used_percent": 94, "memory_free_mb": 351, "memory_total_mb": 1024, "top_consumer": "cef", "description": "Memory utilization exceeded threshold. Top consumer subsystem: cef."}, "devices": [{"name": "EDGE-RTR2", "platform": "cisco_ios_xe", "memory_used_percent": 94, "memory_free_mb": 351, "memory_total_mb": 1024, "top_consumer": "cef"}], "cli_fix": ["memory free low-watermark processor 60000", "memory free low-watermark io 20000", "logging buffered 8192 warnings"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T01:55:26.012215Z", "memory_used_percent": 97, "memory_free_mb": 269, "memory_total_mb": 8192, "top_consumer": "logging", "description": "Memory utilization exceeded threshold. Top consumer subsystem: logging."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 97, "memory_free_mb": 269, "memory_total_mb": 8192, "top_consumer": "logging"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings", "logging persistent size 4096"]}
{"incident_type": "high_memory", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High memory utilization detected", "device": "BRANCH-RTR2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T09:51:26.009189Z", "memory_used_percent": 93, "memory_free_mb": 437, "memory_total_mb": 8192, "top_consumer": "bgp", "description": "Memory utilization exceeded threshold. Top consumer subsystem: bgp."}, "devices": [{"name": "BRANCH-RTR2", "platform": "cisco_ios", "memory_used_percent": 93, "memory_free_mb": 437, "memory_total_mb": 8192, "top_consumer": "bgp"}], "cli_fix": ["no logging console", "logging buffered 8192 warnings"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "DIST-SW2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T04:45:26.006701Z", "cpu_5s_percent": 88, "cpu_1m_percent": 77, "cpu_5m_percent": 83, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "DIST-SW2", "platform": "cisco_ios", "cpu_5s_percent": 88, "cpu_1m_percent": 77, "cpu_5m_percent": 83, "top_process": "BGP Scanner"}], "cli_fix": ["no logging console", "logging buffered 16384 warnings", "service timestamps log datetime msec"]}
{"incident_type": "high_cpu", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "High CPU utilization detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T06:51:26.005210Z", "cpu_5s_percent": 100, "cpu_1m_percent": 99, "cpu_5m_percent": 74, "top_process": "BGP Scanner", "description": "CPU utilization exceeded threshold. Top consumer: BGP Scanner."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios", "cpu_5s_percent": 100, "cpu_1m_percent": 99, "cpu_5m_percent": 74, "top_process": "BGP Scanner"}], "cli_fix": ["no ip http server", "no ip http secure-server", "no service tcp-small-servers", "no service udp-small-servers"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "critical", "source": "wazuh-agent", "timestamp": "2026-02-07T10:27:26.013285Z", "process": "telemetry", "pid": 4859, "crash_count_24h": 15, "last_crash_reason": "Memory corruption", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Memory corruption."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 4859, "crash_count_24h": 15, "last_crash_reason": "Memory corruption"}], "cli_fix": ["exception crashinfo file bootflash:crashinfo", "logging trap warnings", "logging host 10.0.0.10"]}
{"incident_type": "process_crash", "instruction": "Analyze system-level incidents on Cisco IOS/IOS XE devices and output ONLY CLI FIX COMMANDS. Do not explain.", "wazuh_alert": {"rule": "Process crash / restart detected", "device": "CORE-R2", "severity": "high", "source": "wazuh-agent", "timestamp": "2026-02-07T03:27:26.014477Z", "process": "telemetry", "pid": 515, "crash_count_24h": 6, "last_crash_reason": "Unhandled exception", "description": "Process 'telemetry' crashed/restarted multiple times. Last reason: Unhandled exception."}, "devices": [{"name": "CORE-R2", "platform": "cisco_ios_xe", "process": "telemetry", "pid": 515, "crash_count_24h": 6, "last_crash_reason": "Unhandled exception"}], "cli_fix": ["archive", " log config", "  logging enable", "  hidekeys", " exit"]}