{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.19"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.19", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.147", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.19 activate", "exit-address-family", "clear ip bgp 192.0.2.19 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.160"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.160", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.201", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.160 next-hop-self all", "clear ip bgp 192.0.2.160 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.155"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.155", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.26", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65100", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.155 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.145"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.145", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.214", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv4 unicast", "neighbor 192.0.2.145 activate", "exit-address-family", "clear ip bgp 192.0.2.145 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.172"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.172", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.101", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "ok"}], "cli_fix": ["router bgp 65100", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.172 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.186"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.186", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.41", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv4 unicast", "neighbor 192.0.2.186 activate", "neighbor 192.0.2.186 send-community both", "exit-address-family", "clear ip bgp 192.0.2.186 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.238"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.238", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.134", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65002", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.238 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.150"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.150", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.170", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv6 unicast", "neighbor 192.0.2.150 activate", "neighbor 192.0.2.150 send-community both", "exit-address-family", "clear ip bgp 192.0.2.150 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.238"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.238", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.68", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv6 unicast", "neighbor 192.0.2.238 activate", "neighbor 192.0.2.238 send-community both", "exit-address-family", "clear ip bgp 192.0.2.238 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.188"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.188", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "ok"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.183", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65100", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.188 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.64"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.64", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.187", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65010", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.64 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.49"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.49", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.100", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv4 unicast", "neighbor 192.0.2.49 activate", "exit-address-family", "clear ip bgp 192.0.2.49 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.53"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.53", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.3", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.53 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.95"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.95", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.48", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65001", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.95 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.239"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.239", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.208", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", "neighbor 192.0.2.239 activate", "exit-address-family", "clear ip bgp 192.0.2.239 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.41"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.41", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.59", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "none"}], "cli_fix": ["router bgp 65010", "address-family ipv6 unicast", "neighbor 192.0.2.41 activate", "neighbor 192.0.2.41 send-community both", "exit-address-family", "clear ip bgp 192.0.2.41 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.100"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.100", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.111", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.100 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.80"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.80", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.61", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv6 unicast", "neighbor 192.0.2.80 activate", "exit-address-family", "clear ip bgp 192.0.2.80 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.30"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.30", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.139", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "ok"}], "cli_fix": ["router bgp 65002", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.30 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.75"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.75", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "ok"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.41", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "ok"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 198.51.100.2", "router bgp 65002", "clear ip bgp 192.0.2.75 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.192"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.192", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.209", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv6 unicast", "neighbor 192.0.2.192 activate", "exit-address-family", "clear ip bgp 192.0.2.192 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.242"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.242", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.97", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.242 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.189"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.189", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.133", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.189 next-hop-self all", "clear ip bgp 192.0.2.189 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.175"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.175", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.32", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "none"}], "cli_fix": ["router bgp 65010", "address-family ipv4 unicast", "neighbor 192.0.2.175 activate", "exit-address-family", "clear ip bgp 192.0.2.175 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.214"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.214", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.239", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv6 unicast", "neighbor 192.0.2.214 activate", "neighbor 192.0.2.214 send-community both", "exit-address-family", "clear ip bgp 192.0.2.214 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.118"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.118", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.70", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.118 next-hop-self all", "clear ip bgp 192.0.2.118 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.245"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.245", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.100", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv6 unicast", "neighbor 192.0.2.245 activate", "exit-address-family", "clear ip bgp 192.0.2.245 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.190"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.190", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.21", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 192.0.2.254", "router bgp 65001", "clear ip bgp 192.0.2.190 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.19"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.19", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.203", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.19 next-hop-self all", "clear ip bgp 192.0.2.19 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.42"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.42", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.74", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "ok"}], "cli_fix": ["router bgp 65002", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.42 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.20"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.20", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.184", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.20 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.208"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.208", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "ok"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.201", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "ok"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 192.0.2.254", "router bgp 65010", "clear ip bgp 192.0.2.208 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.78"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.78", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.217", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv6 unicast", "neighbor 192.0.2.78 activate", "neighbor 192.0.2.78 send-community both", "exit-address-family", "clear ip bgp 192.0.2.78 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.64"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.64", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.182", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65001", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.64 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.111"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.111", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.246", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv4 unicast", "neighbor 192.0.2.111 activate", "neighbor 192.0.2.111 send-community both", "exit-address-family", "clear ip bgp 192.0.2.111 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.244"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.244", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.88", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.244 next-hop-self", "clear ip bgp 192.0.2.244 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.7"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.7", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.240", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.7 next-hop-self", "clear ip bgp 192.0.2.7 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.183"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.183", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.220", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.183 next-hop-self", "clear ip bgp 192.0.2.183 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.43"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.43", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.134", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.43 activate", "neighbor 192.0.2.43 send-community both", "exit-address-family", "clear ip bgp 192.0.2.43 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.173"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.173", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.140", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.173 next-hop-self", "clear ip bgp 192.0.2.173 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.26"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.26", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.27", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv4 unicast", "neighbor 192.0.2.26 activate", "exit-address-family", "clear ip bgp 192.0.2.26 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.206"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.206", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.86", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["ip route 172.16.5.0 255.255.255.0 192.0.2.254", "router bgp 65010", "clear ip bgp 192.0.2.206 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.162"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.162", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.198", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.162 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.85"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.85", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.100", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.85 next-hop-self", "clear ip bgp 192.0.2.85 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.24"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.24", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.86", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["router bgp 65001", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.24 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.131"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.131", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.143", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["ip route 172.16.5.0 255.255.255.0 192.0.2.254", "router bgp 65002", "clear ip bgp 192.0.2.131 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.127"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.127", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.8", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv4 unicast", "neighbor 192.0.2.127 activate", "exit-address-family", "clear ip bgp 192.0.2.127 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.251"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.251", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.216", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.251 next-hop-self all", "clear ip bgp 192.0.2.251 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.108"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.108", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.146", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.108 next-hop-self all", "clear ip bgp 192.0.2.108 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.7"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.7", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.206", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.7 activate", "neighbor 192.0.2.7 send-community both", "exit-address-family", "clear ip bgp 192.0.2.7 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.220"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.220", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.15", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.220 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.250"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.250", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.142", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "ok"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.250 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.33"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.33", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.84", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv6 unicast", "neighbor 192.0.2.33 activate", "exit-address-family", "clear ip bgp 192.0.2.33 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.208"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.208", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.46", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.208 activate", "exit-address-family", "clear ip bgp 192.0.2.208 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.90"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.90", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.55", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.90 next-hop-self", "clear ip bgp 192.0.2.90 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.207"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.207", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.31", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65001", "address-family ipv4 unicast", "neighbor 192.0.2.207 activate", "exit-address-family", "clear ip bgp 192.0.2.207 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.26"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.26", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.71", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "ok"}], "cli_fix": ["router bgp 65010", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.26 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.66"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.66", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.21", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.66 next-hop-self all", "clear ip bgp 192.0.2.66 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.213"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.213", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.220", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65100", "address-family ipv4 unicast", "neighbor 192.0.2.213 activate", "exit-address-family", "clear ip bgp 192.0.2.213 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.246"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.246", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.58", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.246 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.199"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.199", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.175", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv4 unicast", "neighbor 192.0.2.199 activate", "neighbor 192.0.2.199 send-community both", "exit-address-family", "clear ip bgp 192.0.2.199 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.39"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.39", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.171", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv4 unicast", "neighbor 192.0.2.39 activate", "exit-address-family", "clear ip bgp 192.0.2.39 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.90"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.90", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.73", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.90 next-hop-self all", "clear ip bgp 192.0.2.90 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.132"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.132", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.125", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.132 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.37"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.37", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.126", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65100", "address-family ipv4 unicast", "neighbor 192.0.2.37 activate", "exit-address-family", "clear ip bgp 192.0.2.37 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.96"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.96", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "ok"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.223", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65100", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.96 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.195"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.195", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.130", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.195 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.152"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.152", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.101", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.152 next-hop-self", "clear ip bgp 192.0.2.152 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.154"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.154", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.155", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}], "cli_fix": ["ip route 172.16.5.0 255.255.255.0 10.0.0.1", "router bgp 65010", "clear ip bgp 192.0.2.154 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.18"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.18", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.221", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.18 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.236"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.236", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.60", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", "neighbor 192.0.2.236 activate", "exit-address-family", "clear ip bgp 192.0.2.236 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.209"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.209", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.52", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}], "cli_fix": ["router bgp 65002", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.209 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.254"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.254", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.214", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv6 unicast", "neighbor 192.0.2.254 activate", "neighbor 192.0.2.254 send-community both", "exit-address-family", "clear ip bgp 192.0.2.254 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.60"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.60", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.224", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.60 next-hop-self", "clear ip bgp 192.0.2.60 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.94"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.94", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.47", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65002", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.94 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.240"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.240", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.104", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", "neighbor 192.0.2.240 activate", "exit-address-family", "clear ip bgp 192.0.2.240 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.150"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.150", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.125", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65001", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.150 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.108"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.108", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.83", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.108 next-hop-self all", "clear ip bgp 192.0.2.108 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.160"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.160", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.73", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "ok"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 198.51.100.2", "router bgp 65002", "clear ip bgp 192.0.2.160 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.44"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.44", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.96", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "ok"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.44 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.39"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.39", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.148", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.39 next-hop-self all", "clear ip bgp 192.0.2.39 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.31"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.31", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.48", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.31 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.32"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.32", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "ok"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.34", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65010", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.32 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.200"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.200", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.199", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.200 next-hop-self all", "clear ip bgp 192.0.2.200 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.59"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.59", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.235", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", "neighbor 192.0.2.59 activate", "exit-address-family", "clear ip bgp 192.0.2.59 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.27"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.27", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "ok"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.93", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.27 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.157"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.157", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.124", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.157 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.250"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.250", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.65", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.250 next-hop-self all", "clear ip bgp 192.0.2.250 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.177"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.177", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.89", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "ok"}], "cli_fix": ["router bgp 65100", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.177 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.203"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.203", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.250", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.203 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.177"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.177", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.186", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.177 next-hop-self", "clear ip bgp 192.0.2.177 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.145"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.145", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.89", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", "neighbor 192.0.2.145 activate", "exit-address-family", "clear ip bgp 192.0.2.145 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.228"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.228", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "ok"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.48", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["ip route 10.10.0.0 255.255.0.0 192.0.2.254", "router bgp 65100", "clear ip bgp 192.0.2.228 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.88"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.88", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.34", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "ok"}], "cli_fix": ["ip route 172.16.5.0 255.255.255.0 198.51.100.2", "router bgp 65002", "clear ip bgp 192.0.2.88 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.104"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.104", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.240", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.104 next-hop-self", "clear ip bgp 192.0.2.104 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.55"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.55", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.60", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", "neighbor 192.0.2.55 activate", "neighbor 192.0.2.55 send-community both", "exit-address-family", "clear ip bgp 192.0.2.55 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.231"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.231", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.76", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv6 unicast", "neighbor 192.0.2.231 activate", "neighbor 192.0.2.231 send-community both", "exit-address-family", "clear ip bgp 192.0.2.231 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.159"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.159", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.105", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.159 next-hop-self all", "clear ip bgp 192.0.2.159 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.8"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.8", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.129", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["ip route 10.10.0.0 255.255.0.0 192.0.2.254", "router bgp 65001", "clear ip bgp 192.0.2.8 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.248"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.248", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.185", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65001", "address-family ipv4 unicast", "neighbor 192.0.2.248 activate", "exit-address-family", "clear ip bgp 192.0.2.248 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.71"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.71", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.152", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv4 unicast", "neighbor 192.0.2.71 activate", "neighbor 192.0.2.71 send-community both", "exit-address-family", "clear ip bgp 192.0.2.71 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.221"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.221", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.155", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", "neighbor 192.0.2.221 activate", "neighbor 192.0.2.221 send-community both", "exit-address-family", "clear ip bgp 192.0.2.221 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.208"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.208", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.142", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.208 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.247"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.247", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.39", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv4 unicast", "neighbor 192.0.2.247 activate", "neighbor 192.0.2.247 send-community both", "exit-address-family", "clear ip bgp 192.0.2.247 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.204"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.204", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.230", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.204 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.110"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.110", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.174", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "ok"}], "cli_fix": ["router bgp 65100", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.110 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.213"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.213", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.219", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.213 next-hop-self", "clear ip bgp 192.0.2.213 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.20"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.20", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.213", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "ok"}], "cli_fix": ["ip route 172.16.5.0 255.255.255.0 198.51.100.2", "router bgp 65100", "clear ip bgp 192.0.2.20 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.107"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.107", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.243", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65001", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.107 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.13"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.13", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.82", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv4 unicast", "neighbor 192.0.2.13 activate", "neighbor 192.0.2.13 send-community both", "exit-address-family", "clear ip bgp 192.0.2.13 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.232"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.232", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.21", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.232 next-hop-self all", "clear ip bgp 192.0.2.232 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.37"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.37", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.8", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.37 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.16"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.16", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.18", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.16 next-hop-self all", "clear ip bgp 192.0.2.16 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.99"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.99", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.11", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.99 next-hop-self all", "clear ip bgp 192.0.2.99 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.155"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.155", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.84", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "none"}], "cli_fix": ["router bgp 65001", "address-family ipv4 unicast", "neighbor 192.0.2.155 activate", "neighbor 192.0.2.155 send-community both", "exit-address-family", "clear ip bgp 192.0.2.155 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.13"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.13", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.215", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv4 unicast", "neighbor 192.0.2.13 activate", "exit-address-family", "clear ip bgp 192.0.2.13 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.188"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.188", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.154", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv4 unicast", "neighbor 192.0.2.188 activate", "neighbor 192.0.2.188 send-community both", "exit-address-family", "clear ip bgp 192.0.2.188 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.98"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.98", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "ok"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.238", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}], "cli_fix": ["ip route 172.16.5.0 255.255.255.0 198.51.100.2", "router bgp 65010", "clear ip bgp 192.0.2.98 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.85"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.85", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.84", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65100", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.85 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.94"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.94", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.3", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.94 next-hop-self all", "clear ip bgp 192.0.2.94 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.15"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.15", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.235", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.15 next-hop-self all", "clear ip bgp 192.0.2.15 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.188"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.188", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.6", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "none"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", "neighbor 192.0.2.188 activate", "exit-address-family", "clear ip bgp 192.0.2.188 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.73"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.73", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.227", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65010", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.73 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.170"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.170", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.42", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.170 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.4"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.4", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "ok"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.104", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "ok"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 192.0.2.254", "router bgp 65100", "clear ip bgp 192.0.2.4 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.134"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.134", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.136", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65100", "address-family ipv4 unicast", "neighbor 192.0.2.134 activate", "neighbor 192.0.2.134 send-community both", "exit-address-family", "clear ip bgp 192.0.2.134 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.137"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.137", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.152", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "ok"}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.137 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.40"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.40", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "ok"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.216", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["router bgp 65002", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.40 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.13"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.13", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.231", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.13 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.35"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.35", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "ok"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.183", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.35 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.223"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.223", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.201", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv6 unicast", "neighbor 192.0.2.223 activate", "neighbor 192.0.2.223 send-community both", "exit-address-family", "clear ip bgp 192.0.2.223 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.242"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.242", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.64", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.242 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.158"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.158", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "ok"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.124", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.158 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.157"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.157", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.160", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.157 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.33"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.33", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.108", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv4 unicast", "neighbor 192.0.2.33 activate", "exit-address-family", "clear ip bgp 192.0.2.33 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.43"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.43", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.146", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.43 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.176"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.176", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.217", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", "neighbor 192.0.2.176 activate", "neighbor 192.0.2.176 send-community both", "exit-address-family", "clear ip bgp 192.0.2.176 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.31"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.31", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.158", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}], "cli_fix": ["ip route 172.16.5.0 255.255.255.0 198.51.100.2", "router bgp 65001", "clear ip bgp 192.0.2.31 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.238"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.238", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "ok"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.28", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65100", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.238 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.154"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.154", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.83", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "none"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", "neighbor 192.0.2.154 activate", "neighbor 192.0.2.154 send-community both", "exit-address-family", "clear ip bgp 192.0.2.154 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.198"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.198", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.29", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv4 unicast", "neighbor 192.0.2.198 activate", "neighbor 192.0.2.198 send-community both", "exit-address-family", "clear ip bgp 192.0.2.198 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.55"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.55", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.11", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "none"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", "neighbor 192.0.2.55 activate", "exit-address-family", "clear ip bgp 192.0.2.55 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.10"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.10", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "ok"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.131", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "ok"}], "cli_fix": ["ip route 10.10.0.0 255.255.0.0 198.51.100.2", "router bgp 65002", "clear ip bgp 192.0.2.10 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.176"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.176", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.91", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.176 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.28"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.28", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.183", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.28 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.181"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.181", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.115", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "none"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.181 activate", "exit-address-family", "clear ip bgp 192.0.2.181 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.163"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.163", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.189", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.163 next-hop-self", "clear ip bgp 192.0.2.163 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.110"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.110", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.95", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", "neighbor 192.0.2.110 activate", "exit-address-family", "clear ip bgp 192.0.2.110 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.84"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.84", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.96", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv4 unicast", "neighbor 192.0.2.84 activate", "neighbor 192.0.2.84 send-community both", "exit-address-family", "clear ip bgp 192.0.2.84 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.97"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.97", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.15", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.97 activate", "exit-address-family", "clear ip bgp 192.0.2.97 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.96"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.96", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.64", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.96 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.196"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.196", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.190", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.196 next-hop-self all", "clear ip bgp 192.0.2.196 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.70"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.70", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "ok"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.120", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 198.51.100.2", "router bgp 65100", "clear ip bgp 192.0.2.70 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.83"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.83", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "ok"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.63", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "ok"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.83 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.72"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.72", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.203", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.72 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.38"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.38", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.61", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.38 activate", "neighbor 192.0.2.38 send-community both", "exit-address-family", "clear ip bgp 192.0.2.38 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.245"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.245", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.6", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", "neighbor 192.0.2.245 activate", "neighbor 192.0.2.245 send-community both", "exit-address-family", "clear ip bgp 192.0.2.245 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.29"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.29", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.111", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "ok"}], "cli_fix": ["router bgp 65100", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.29 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.61"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.61", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.108", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}], "cli_fix": ["ip route 10.10.0.0 255.255.0.0 192.0.2.254", "router bgp 65001", "clear ip bgp 192.0.2.61 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.242"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.242", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.113", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.242 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.163"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.163", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.99", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["router bgp 65002", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.163 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.221"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.221", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.1", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.221 next-hop-self all", "clear ip bgp 192.0.2.221 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.126"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.126", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.128", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65001", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.126 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.126"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.126", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.230", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.126 next-hop-self", "clear ip bgp 192.0.2.126 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.39"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.39", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.3", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.39 activate", "neighbor 192.0.2.39 send-community both", "exit-address-family", "clear ip bgp 192.0.2.39 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.73"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.73", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "ok"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.98", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["router bgp 65100", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.73 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.202"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.202", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.116", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", "neighbor 192.0.2.202 activate", "exit-address-family", "clear ip bgp 192.0.2.202 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.104"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.104", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.95", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 192.0.2.254", "router bgp 65010", "clear ip bgp 192.0.2.104 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.212"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.212", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.37", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65100", "address-family ipv6 unicast", "neighbor 192.0.2.212 activate", "neighbor 192.0.2.212 send-community both", "exit-address-family", "clear ip bgp 192.0.2.212 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.57"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.57", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "ok"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.252", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["router bgp 65002", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.57 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.174"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.174", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.236", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "none"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", "neighbor 192.0.2.174 activate", "exit-address-family", "clear ip bgp 192.0.2.174 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.132"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.132", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.97", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.132 activate", "neighbor 192.0.2.132 send-community both", "exit-address-family", "clear ip bgp 192.0.2.132 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.116"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.116", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.227", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.116 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.233"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.233", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.210", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.233 next-hop-self", "clear ip bgp 192.0.2.233 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.168"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.168", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.96", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.168 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.23"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.23", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.73", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", "neighbor 192.0.2.23 activate", "neighbor 192.0.2.23 send-community both", "exit-address-family", "clear ip bgp 192.0.2.23 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.138"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.138", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.12", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.138 next-hop-self", "clear ip bgp 192.0.2.138 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.42"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.42", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.175", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65010", "address-family ipv4 unicast", "neighbor 192.0.2.42 activate", "exit-address-family", "clear ip bgp 192.0.2.42 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.67"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.67", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.114", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65100", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.67 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.185"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.185", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.77", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.185 activate", "exit-address-family", "clear ip bgp 192.0.2.185 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.222"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.222", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.194", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.222 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.129"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.129", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.148", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.129 next-hop-self", "clear ip bgp 192.0.2.129 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.46"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.46", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "ok"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.212", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}], "cli_fix": ["router bgp 65002", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.46 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.168"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.168", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.195", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.168 next-hop-self all", "clear ip bgp 192.0.2.168 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.161"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.161", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.68", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.161 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.90"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.90", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.77", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.90 next-hop-self all", "clear ip bgp 192.0.2.90 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.21"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.21", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.192", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.21 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.245"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.245", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.175", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv4 unicast", "neighbor 192.0.2.245 activate", "exit-address-family", "clear ip bgp 192.0.2.245 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.5"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.5", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.110", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "none"}], "cli_fix": ["router bgp 65100", "address-family ipv4 unicast", "neighbor 192.0.2.5 activate", "exit-address-family", "clear ip bgp 192.0.2.5 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.86"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.86", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.15", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", "neighbor 192.0.2.86 activate", "neighbor 192.0.2.86 send-community both", "exit-address-family", "clear ip bgp 192.0.2.86 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.103"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.103", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.80", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "none"}], "cli_fix": ["router bgp 65010", "address-family ipv4 unicast", "neighbor 192.0.2.103 activate", "exit-address-family", "clear ip bgp 192.0.2.103 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.163"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.163", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.6", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv4 unicast", "neighbor 192.0.2.163 activate", "exit-address-family", "clear ip bgp 192.0.2.163 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.205"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.205", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.108", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65010", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.205 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.220"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.220", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.100", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv4 unicast", "neighbor 192.0.2.220 activate", "exit-address-family", "clear ip bgp 192.0.2.220 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.114"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.114", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.245", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", "neighbor 192.0.2.114 activate", "exit-address-family", "clear ip bgp 192.0.2.114 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.174"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.174", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.223", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv4 unicast", "neighbor 192.0.2.174 activate", "exit-address-family", "clear ip bgp 192.0.2.174 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.65"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.65", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.25", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", "neighbor 192.0.2.65 activate", "neighbor 192.0.2.65 send-community both", "exit-address-family", "clear ip bgp 192.0.2.65 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.181"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.181", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.151", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv4 unicast", "neighbor 192.0.2.181 activate", "exit-address-family", "clear ip bgp 192.0.2.181 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.111"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.111", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.141", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.111 next-hop-self", "clear ip bgp 192.0.2.111 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.145"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.145", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.155", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.145 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.61"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.61", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.214", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.61 next-hop-self all", "clear ip bgp 192.0.2.61 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.153"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.153", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.241", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.153 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.120"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.120", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.243", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.120 next-hop-self", "clear ip bgp 192.0.2.120 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.162"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.162", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.72", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.162 next-hop-self all", "clear ip bgp 192.0.2.162 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.86"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.86", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.205", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["router bgp 65100", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.86 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.100"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.100", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.198", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", "neighbor 192.0.2.100 activate", "exit-address-family", "clear ip bgp 192.0.2.100 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.93"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.93", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.147", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "ok"}], "cli_fix": ["router bgp 65100", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.93 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.103"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.103", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.227", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv4 unicast", "neighbor 192.0.2.103 activate", "neighbor 192.0.2.103 send-community both", "exit-address-family", "clear ip bgp 192.0.2.103 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.197"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.197", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.129", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "none"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.197 activate", "neighbor 192.0.2.197 send-community both", "exit-address-family", "clear ip bgp 192.0.2.197 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.32"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.32", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.222", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["router bgp 65001", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.32 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.117"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.117", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.215", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.117 next-hop-self all", "clear ip bgp 192.0.2.117 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.189"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.189", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.25", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.189 next-hop-self all", "clear ip bgp 192.0.2.189 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.127"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.127", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.201", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.127 next-hop-self all", "clear ip bgp 192.0.2.127 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.209"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.209", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.112", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65100", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.209 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.223"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.223", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.80", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65100", "address-family ipv4 unicast", "neighbor 192.0.2.223 activate", "neighbor 192.0.2.223 send-community both", "exit-address-family", "clear ip bgp 192.0.2.223 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.98"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.98", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.206", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv6 unicast", "neighbor 192.0.2.98 activate", "neighbor 192.0.2.98 send-community both", "exit-address-family", "clear ip bgp 192.0.2.98 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.101"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.101", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.133", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.101 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.65"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.65", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.202", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.65 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.238"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.238", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.127", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.238 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.142"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.142", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.106", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", "neighbor 192.0.2.142 activate", "exit-address-family", "clear ip bgp 192.0.2.142 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.114"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.114", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.199", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.114 next-hop-self all", "clear ip bgp 192.0.2.114 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.139"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.139", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.23", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}], "cli_fix": ["ip route 172.16.5.0 255.255.255.0 198.51.100.2", "router bgp 65100", "clear ip bgp 192.0.2.139 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.20"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.20", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.65", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65100", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.20 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.247"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.247", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.20", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.247 next-hop-self all", "clear ip bgp 192.0.2.247 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.54"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.54", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.80", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.54 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.94"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.94", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.5", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.94 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.150"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.150", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.143", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.150 activate", "exit-address-family", "clear ip bgp 192.0.2.150 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.230"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.230", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.3", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65010", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.230 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.144"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.144", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "ok"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.233", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 192.0.2.254", "router bgp 65010", "clear ip bgp 192.0.2.144 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.167"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.167", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.96", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv6 unicast", "neighbor 192.0.2.167 activate", "neighbor 192.0.2.167 send-community both", "exit-address-family", "clear ip bgp 192.0.2.167 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.49"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.49", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.138", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.49 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.4"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.4", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.34", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.4 next-hop-self all", "clear ip bgp 192.0.2.4 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.95"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.95", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.218", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65100", "address-family ipv4 unicast", "neighbor 192.0.2.95 activate", "neighbor 192.0.2.95 send-community both", "exit-address-family", "clear ip bgp 192.0.2.95 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.176"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.176", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.101", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["router bgp 65100", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.176 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.133"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.133", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "ok"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.225", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["ip route 172.16.5.0 255.255.255.0 198.51.100.2", "router bgp 65010", "clear ip bgp 192.0.2.133 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.170"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.170", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.123", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv6 unicast", "neighbor 192.0.2.170 activate", "exit-address-family", "clear ip bgp 192.0.2.170 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.234"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.234", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.145", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.234 next-hop-self", "clear ip bgp 192.0.2.234 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.151"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.151", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.185", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "none"}], "cli_fix": ["router bgp 65010", "address-family ipv6 unicast", "neighbor 192.0.2.151 activate", "neighbor 192.0.2.151 send-community both", "exit-address-family", "clear ip bgp 192.0.2.151 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.223"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.223", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.211", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.223 activate", "exit-address-family", "clear ip bgp 192.0.2.223 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.140"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.140", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.140", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.140 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.46"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.46", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.195", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.46 next-hop-self", "clear ip bgp 192.0.2.46 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.23"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.23", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "ok"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.64", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}], "cli_fix": ["ip route 10.10.0.0 255.255.0.0 10.0.0.1", "router bgp 65001", "clear ip bgp 192.0.2.23 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.4"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.4", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.179", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv6 unicast", "neighbor 192.0.2.4 activate", "exit-address-family", "clear ip bgp 192.0.2.4 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.179"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.179", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.73", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", "neighbor 192.0.2.179 activate", "exit-address-family", "clear ip bgp 192.0.2.179 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.150"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.150", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.98", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "ok"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.150 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.247"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.247", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.107", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 10.0.0.1", "router bgp 65010", "clear ip bgp 192.0.2.247 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.79"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.79", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.233", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.79 next-hop-self", "clear ip bgp 192.0.2.79 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.66"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.66", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "ok"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.126", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.66 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.241"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.241", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.85", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv6 unicast", "neighbor 192.0.2.241 activate", "exit-address-family", "clear ip bgp 192.0.2.241 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.220"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.220", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.94", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv4 unicast", "neighbor 192.0.2.220 activate", "exit-address-family", "clear ip bgp 192.0.2.220 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.10"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.10", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.78", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", "neighbor 192.0.2.10 activate", "exit-address-family", "clear ip bgp 192.0.2.10 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.164"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.164", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.112", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65010", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.164 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.153"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.153", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.232", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "ok"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 10.0.0.1", "router bgp 65010", "clear ip bgp 192.0.2.153 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.116"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.116", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.8", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "none"}], "cli_fix": ["router bgp 65001", "address-family ipv4 unicast", "neighbor 192.0.2.116 activate", "exit-address-family", "clear ip bgp 192.0.2.116 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.75"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.75", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.120", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "ok"}], "cli_fix": ["router bgp 65100", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.75 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.181"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.181", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.223", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.181 activate", "neighbor 192.0.2.181 send-community both", "exit-address-family", "clear ip bgp 192.0.2.181 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.209"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.209", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.28", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", "neighbor 192.0.2.209 activate", "neighbor 192.0.2.209 send-community both", "exit-address-family", "clear ip bgp 192.0.2.209 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.79"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.79", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.209", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.79 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.8"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.8", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.28", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.8 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.54"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.54", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.40", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "ok"}], "cli_fix": ["router bgp 65001", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.54 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.215"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.215", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.149", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv6 unicast", "neighbor 192.0.2.215 activate", "neighbor 192.0.2.215 send-community both", "exit-address-family", "clear ip bgp 192.0.2.215 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.196"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.196", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.200", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv4 unicast", "neighbor 192.0.2.196 activate", "neighbor 192.0.2.196 send-community both", "exit-address-family", "clear ip bgp 192.0.2.196 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.238"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.238", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.43", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65100", "address-family ipv4 unicast", "neighbor 192.0.2.238 activate", "neighbor 192.0.2.238 send-community both", "exit-address-family", "clear ip bgp 192.0.2.238 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.102"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.102", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.177", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.102 activate", "exit-address-family", "clear ip bgp 192.0.2.102 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.251"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.251", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.181", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.251 next-hop-self all", "clear ip bgp 192.0.2.251 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.220"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.220", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "ok"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.229", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["ip route 172.16.5.0 255.255.255.0 198.51.100.2", "router bgp 65002", "clear ip bgp 192.0.2.220 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.129"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.129", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.95", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.129 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.216"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.216", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.53", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65100", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.216 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.117"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.117", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "ok"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.51", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 10.0.0.1", "router bgp 65010", "clear ip bgp 192.0.2.117 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.102"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.102", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.169", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.102 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.91"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.91", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.248", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65100", "address-family ipv6 unicast", "neighbor 192.0.2.91 activate", "exit-address-family", "clear ip bgp 192.0.2.91 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.99"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.99", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.61", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", "neighbor 192.0.2.99 activate", "exit-address-family", "clear ip bgp 192.0.2.99 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.109"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.109", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.113", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", "neighbor 192.0.2.109 activate", "exit-address-family", "clear ip bgp 192.0.2.109 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.181"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.181", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.86", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.181 next-hop-self all", "clear ip bgp 192.0.2.181 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.68"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.68", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.6", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "ok"}], "cli_fix": ["ip route 172.16.5.0 255.255.255.0 10.0.0.1", "router bgp 65001", "clear ip bgp 192.0.2.68 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.88"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.88", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.38", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.88 next-hop-self", "clear ip bgp 192.0.2.88 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.23"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.23", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.164", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.23 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.181"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.181", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "ok"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.13", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "ok"}], "cli_fix": ["ip route 172.16.5.0 255.255.255.0 192.0.2.254", "router bgp 65010", "clear ip bgp 192.0.2.181 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.206"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.206", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.37", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv4 unicast", "neighbor 192.0.2.206 activate", "neighbor 192.0.2.206 send-community both", "exit-address-family", "clear ip bgp 192.0.2.206 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.60"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.60", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.37", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65001", "address-family ipv4 unicast", "neighbor 192.0.2.60 activate", "neighbor 192.0.2.60 send-community both", "exit-address-family", "clear ip bgp 192.0.2.60 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.126"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.126", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.212", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.126 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.109"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.109", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.136", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", "neighbor 192.0.2.109 activate", "exit-address-family", "clear ip bgp 192.0.2.109 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.171"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.171", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.210", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.171 next-hop-self all", "clear ip bgp 192.0.2.171 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.244"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.244", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.30", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.244 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.54"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.54", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.135", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv4 unicast", "neighbor 192.0.2.54 activate", "exit-address-family", "clear ip bgp 192.0.2.54 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.203"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.203", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.22", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv4 unicast", "neighbor 192.0.2.203 activate", "neighbor 192.0.2.203 send-community both", "exit-address-family", "clear ip bgp 192.0.2.203 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.215"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.215", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.201", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.215 next-hop-self all", "clear ip bgp 192.0.2.215 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.113"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.113", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.73", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv4 unicast", "neighbor 192.0.2.113 activate", "exit-address-family", "clear ip bgp 192.0.2.113 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.179"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.179", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.191", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 192.0.2.254", "router bgp 65010", "clear ip bgp 192.0.2.179 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.106"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.106", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.157", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["ip route 172.16.5.0 255.255.255.0 10.0.0.1", "router bgp 65002", "clear ip bgp 192.0.2.106 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.166"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.166", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.214", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv4 unicast", "neighbor 192.0.2.166 activate", "neighbor 192.0.2.166 send-community both", "exit-address-family", "clear ip bgp 192.0.2.166 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.203"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.203", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.73", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "ok"}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.203 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.208"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.208", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.27", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv4 unicast", "neighbor 192.0.2.208 activate", "neighbor 192.0.2.208 send-community both", "exit-address-family", "clear ip bgp 192.0.2.208 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.173"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.173", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.113", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65001", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.173 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.231"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.231", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.17", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv4 unicast", "neighbor 192.0.2.231 activate", "neighbor 192.0.2.231 send-community both", "exit-address-family", "clear ip bgp 192.0.2.231 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.203"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.203", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.163", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["router bgp 65100", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.203 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.23"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.23", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.126", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65010", "address-family ipv4 unicast", "neighbor 192.0.2.23 activate", "exit-address-family", "clear ip bgp 192.0.2.23 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.104"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.104", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.227", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.104 next-hop-self", "clear ip bgp 192.0.2.104 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.50"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.50", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.98", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "ok"}], "cli_fix": ["ip route 172.16.5.0 255.255.255.0 198.51.100.2", "router bgp 65002", "clear ip bgp 192.0.2.50 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.55"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.55", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.8", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.55 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.167"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.167", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.155", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", "neighbor 192.0.2.167 activate", "exit-address-family", "clear ip bgp 192.0.2.167 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.184"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.184", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.245", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.184 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.119"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.119", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.81", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65100", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.119 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.98"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.98", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.114", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65010", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.98 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.122"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.122", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.99", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", "neighbor 192.0.2.122 activate", "neighbor 192.0.2.122 send-community both", "exit-address-family", "clear ip bgp 192.0.2.122 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.242"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.242", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.174", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.242 activate", "exit-address-family", "clear ip bgp 192.0.2.242 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.170"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.170", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.114", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.170 next-hop-self all", "clear ip bgp 192.0.2.170 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.42"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.42", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.114", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.42 next-hop-self", "clear ip bgp 192.0.2.42 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.92"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.92", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.210", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}], "cli_fix": ["ip route 172.16.5.0 255.255.255.0 192.0.2.254", "router bgp 65002", "clear ip bgp 192.0.2.92 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.16"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.16", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "ok"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.22", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}], "cli_fix": ["router bgp 65001", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.16 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.207"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.207", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "ok"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.186", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 198.51.100.2", "router bgp 65001", "clear ip bgp 192.0.2.207 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.133"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.133", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.57", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["ip route 10.10.0.0 255.255.0.0 198.51.100.2", "router bgp 65100", "clear ip bgp 192.0.2.133 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.24"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.24", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.189", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "none"}], "cli_fix": ["router bgp 65010", "address-family ipv6 unicast", "neighbor 192.0.2.24 activate", "neighbor 192.0.2.24 send-community both", "exit-address-family", "clear ip bgp 192.0.2.24 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.27"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.27", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.200", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv4 unicast", "neighbor 192.0.2.27 activate", "neighbor 192.0.2.27 send-community both", "exit-address-family", "clear ip bgp 192.0.2.27 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.224"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.224", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.204", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.224 next-hop-self all", "clear ip bgp 192.0.2.224 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.207"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.207", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.106", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65010", "address-family ipv6 unicast", "neighbor 192.0.2.207 activate", "neighbor 192.0.2.207 send-community both", "exit-address-family", "clear ip bgp 192.0.2.207 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.53"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.53", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.16", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 198.51.100.2", "router bgp 65002", "clear ip bgp 192.0.2.53 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.181"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.181", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.90", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.181 activate", "neighbor 192.0.2.181 send-community both", "exit-address-family", "clear ip bgp 192.0.2.181 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.131"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.131", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.94", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.131 next-hop-self", "clear ip bgp 192.0.2.131 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.246"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.246", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.160", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.246 next-hop-self", "clear ip bgp 192.0.2.246 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.61"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.61", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.124", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "ok"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.61 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.160"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.160", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.203", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65002", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.160 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.16"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.16", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.8", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv4 unicast", "neighbor 192.0.2.16 activate", "exit-address-family", "clear ip bgp 192.0.2.16 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.55"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.55", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.206", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.55 activate", "exit-address-family", "clear ip bgp 192.0.2.55 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.88"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.88", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.245", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.88 next-hop-self", "clear ip bgp 192.0.2.88 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.215"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.215", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.208", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.215 next-hop-self all", "clear ip bgp 192.0.2.215 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.22"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.22", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.13", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", "neighbor 192.0.2.22 activate", "exit-address-family", "clear ip bgp 192.0.2.22 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.77"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.77", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "ok"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.72", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.77 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.170"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.170", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.239", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.170 next-hop-self all", "clear ip bgp 192.0.2.170 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.32"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.32", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "ok"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.88", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 10.0.0.1", "router bgp 65010", "clear ip bgp 192.0.2.32 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.226"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.226", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.24", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.226 next-hop-self all", "clear ip bgp 192.0.2.226 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.223"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.223", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.3", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["router bgp 65001", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.223 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.2"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.2", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.209", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["router bgp 65010", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.2 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.68"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.68", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.213", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv4 unicast", "neighbor 192.0.2.68 activate", "neighbor 192.0.2.68 send-community both", "exit-address-family", "clear ip bgp 192.0.2.68 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.110"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.110", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.235", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv6 unicast", "neighbor 192.0.2.110 activate", "exit-address-family", "clear ip bgp 192.0.2.110 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.168"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.168", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.157", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv4 unicast", "neighbor 192.0.2.168 activate", "exit-address-family", "clear ip bgp 192.0.2.168 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.128"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.128", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.114", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.128 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.85"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.85", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.184", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.85 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.89"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.89", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.111", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "none"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.89 activate", "neighbor 192.0.2.89 send-community both", "exit-address-family", "clear ip bgp 192.0.2.89 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.218"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.218", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.231", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.218 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.118"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.118", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.98", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", "neighbor 192.0.2.118 activate", "exit-address-family", "clear ip bgp 192.0.2.118 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.14"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.14", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.88", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65001", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.14 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.227"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.227", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.167", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "none"}], "cli_fix": ["router bgp 65010", "address-family ipv4 unicast", "neighbor 192.0.2.227 activate", "neighbor 192.0.2.227 send-community both", "exit-address-family", "clear ip bgp 192.0.2.227 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.219"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.219", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.95", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.219 activate", "neighbor 192.0.2.219 send-community both", "exit-address-family", "clear ip bgp 192.0.2.219 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.168"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.168", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.86", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65002", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.168 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.149"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.149", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.70", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.149 next-hop-self", "clear ip bgp 192.0.2.149 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.145"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.145", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.112", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["router bgp 65002", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.145 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.241"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.241", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.111", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "ok"}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.241 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.245"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.245", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.136", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv6 unicast", "neighbor 192.0.2.245 activate", "neighbor 192.0.2.245 send-community both", "exit-address-family", "clear ip bgp 192.0.2.245 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.248"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.248", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.225", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.248 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.181"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.181", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.172", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.181 next-hop-self all", "clear ip bgp 192.0.2.181 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.244"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.244", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.144", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.244 next-hop-self all", "clear ip bgp 192.0.2.244 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.204"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.204", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.188", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv6 unicast", "neighbor 192.0.2.204 activate", "neighbor 192.0.2.204 send-community both", "exit-address-family", "clear ip bgp 192.0.2.204 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.35"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.35", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.87", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.35 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.226"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.226", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.242", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65010", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.226 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.153"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.153", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.15", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["router bgp 65100", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.153 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.151"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.151", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.119", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}], "cli_fix": ["ip route 10.10.0.0 255.255.0.0 198.51.100.2", "router bgp 65001", "clear ip bgp 192.0.2.151 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.202"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.202", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.117", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "ok"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 10.0.0.1", "router bgp 65002", "clear ip bgp 192.0.2.202 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.81"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.81", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.84", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65001", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.81 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.54"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.54", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.128", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.54 next-hop-self all", "clear ip bgp 192.0.2.54 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.79"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.79", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.114", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.79 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.92"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.92", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "ok"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.65", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "ok"}], "cli_fix": ["ip route 172.16.5.0 255.255.255.0 198.51.100.2", "router bgp 65100", "clear ip bgp 192.0.2.92 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.144"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.144", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.41", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv4 unicast", "neighbor 192.0.2.144 activate", "exit-address-family", "clear ip bgp 192.0.2.144 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.211"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.211", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.55", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["router bgp 65002", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.211 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.38"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.38", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.190", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.38 activate", "exit-address-family", "clear ip bgp 192.0.2.38 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.178"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.178", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.142", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv6 unicast", "neighbor 192.0.2.178 activate", "exit-address-family", "clear ip bgp 192.0.2.178 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.103"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.103", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.2", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65010", "address-family ipv6 unicast", "neighbor 192.0.2.103 activate", "neighbor 192.0.2.103 send-community both", "exit-address-family", "clear ip bgp 192.0.2.103 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.4"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.4", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "ok"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.63", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "ok"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 10.0.0.1", "router bgp 65001", "clear ip bgp 192.0.2.4 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.11"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.11", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.232", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", "neighbor 192.0.2.11 activate", "neighbor 192.0.2.11 send-community both", "exit-address-family", "clear ip bgp 192.0.2.11 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.229"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.229", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.252", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.229 activate", "neighbor 192.0.2.229 send-community both", "exit-address-family", "clear ip bgp 192.0.2.229 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.41"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.41", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.225", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.41 next-hop-self", "clear ip bgp 192.0.2.41 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.110"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.110", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.235", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.110 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.157"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.157", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.116", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.157 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.4"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.4", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.248", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", "neighbor 192.0.2.4 activate", "neighbor 192.0.2.4 send-community both", "exit-address-family", "clear ip bgp 192.0.2.4 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.235"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.235", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.36", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv4 unicast", "neighbor 192.0.2.235 activate", "exit-address-family", "clear ip bgp 192.0.2.235 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.160"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.160", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.226", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65010", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.160 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.79"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.79", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.175", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.79 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.250"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.250", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.129", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv6 unicast", "neighbor 192.0.2.250 activate", "exit-address-family", "clear ip bgp 192.0.2.250 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.97"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.97", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.49", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", "neighbor 192.0.2.97 activate", "neighbor 192.0.2.97 send-community both", "exit-address-family", "clear ip bgp 192.0.2.97 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.146"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.146", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.140", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.146 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.215"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.215", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.61", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.215 activate", "neighbor 192.0.2.215 send-community both", "exit-address-family", "clear ip bgp 192.0.2.215 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.38"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.38", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.173", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv6 unicast", "neighbor 192.0.2.38 activate", "neighbor 192.0.2.38 send-community both", "exit-address-family", "clear ip bgp 192.0.2.38 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.49"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.49", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.77", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65010", "address-family ipv6 unicast", "neighbor 192.0.2.49 activate", "neighbor 192.0.2.49 send-community both", "exit-address-family", "clear ip bgp 192.0.2.49 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.120"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.120", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "ok"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.152", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["ip route 10.10.0.0 255.255.0.0 192.0.2.254", "router bgp 65100", "clear ip bgp 192.0.2.120 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.79"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.79", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.179", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv4 unicast", "neighbor 192.0.2.79 activate", "neighbor 192.0.2.79 send-community both", "exit-address-family", "clear ip bgp 192.0.2.79 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.150"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.150", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.180", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.150 next-hop-self all", "clear ip bgp 192.0.2.150 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.173"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.173", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.205", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.173 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.47"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.47", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.140", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.47 next-hop-self", "clear ip bgp 192.0.2.47 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.245"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.245", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.164", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.245 activate", "neighbor 192.0.2.245 send-community both", "exit-address-family", "clear ip bgp 192.0.2.245 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.82"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.82", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.139", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.82 next-hop-self all", "clear ip bgp 192.0.2.82 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.129"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.129", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.9", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.129 activate", "exit-address-family", "clear ip bgp 192.0.2.129 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.111"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.111", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.33", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv6 unicast", "neighbor 192.0.2.111 activate", "exit-address-family", "clear ip bgp 192.0.2.111 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.241"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.241", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.88", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.241 next-hop-self", "clear ip bgp 192.0.2.241 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.22"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.22", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.134", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.22 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.94"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.94", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.69", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65100", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.94 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.158"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.158", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "ok"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.55", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.158 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.35"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.35", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.202", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.35 activate", "neighbor 192.0.2.35 send-community both", "exit-address-family", "clear ip bgp 192.0.2.35 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.249"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.249", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.61", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.249 next-hop-self all", "clear ip bgp 192.0.2.249 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.231"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.231", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.128", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "ok"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 192.0.2.254", "router bgp 65001", "clear ip bgp 192.0.2.231 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.187"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.187", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.249", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.187 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.254"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.254", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.191", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.254 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.253"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.253", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.69", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.253 activate", "exit-address-family", "clear ip bgp 192.0.2.253 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.223"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.223", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.13", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65100", "address-family ipv6 unicast", "neighbor 192.0.2.223 activate", "neighbor 192.0.2.223 send-community both", "exit-address-family", "clear ip bgp 192.0.2.223 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.211"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.211", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.219", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", "neighbor 192.0.2.211 activate", "neighbor 192.0.2.211 send-community both", "exit-address-family", "clear ip bgp 192.0.2.211 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.232"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.232", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "ok"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.135", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65001", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.232 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.231"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.231", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.172", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.231 next-hop-self", "clear ip bgp 192.0.2.231 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.137"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.137", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.72", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.137 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.34"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.34", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.119", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.34 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.109"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.109", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.177", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.109 next-hop-self", "clear ip bgp 192.0.2.109 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.161"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.161", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.247", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", "neighbor 192.0.2.161 activate", "exit-address-family", "clear ip bgp 192.0.2.161 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.32"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.32", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "ok"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.227", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.32 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.104"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.104", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.247", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.104 next-hop-self all", "clear ip bgp 192.0.2.104 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.207"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.207", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.191", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["ip route 10.10.0.0 255.255.0.0 10.0.0.1", "router bgp 65001", "clear ip bgp 192.0.2.207 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.139"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.139", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.149", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.139 next-hop-self", "clear ip bgp 192.0.2.139 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.187"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.187", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.203", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 198.51.100.2", "router bgp 65100", "clear ip bgp 192.0.2.187 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.229"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.229", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.64", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.229 next-hop-self all", "clear ip bgp 192.0.2.229 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.235"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.235", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.52", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.235 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.129"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.129", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.88", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.129 next-hop-self all", "clear ip bgp 192.0.2.129 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.35"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.35", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.36", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "none"}], "cli_fix": ["router bgp 65100", "address-family ipv4 unicast", "neighbor 192.0.2.35 activate", "neighbor 192.0.2.35 send-community both", "exit-address-family", "clear ip bgp 192.0.2.35 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.93"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.93", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.111", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "none"}], "cli_fix": ["router bgp 65001", "address-family ipv4 unicast", "neighbor 192.0.2.93 activate", "exit-address-family", "clear ip bgp 192.0.2.93 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.184"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.184", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.205", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.184 next-hop-self", "clear ip bgp 192.0.2.184 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.178"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.178", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.143", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 192.0.2.254", "router bgp 65002", "clear ip bgp 192.0.2.178 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.165"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.165", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.170", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "ok"}], "cli_fix": ["router bgp 65002", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.165 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.48"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.48", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.219", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.48 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.241"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.241", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.130", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.241 activate", "neighbor 192.0.2.241 send-community both", "exit-address-family", "clear ip bgp 192.0.2.241 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.82"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.82", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.7", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.82 next-hop-self all", "clear ip bgp 192.0.2.82 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.245"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.245", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.51", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv4 unicast", "neighbor 192.0.2.245 activate", "neighbor 192.0.2.245 send-community both", "exit-address-family", "clear ip bgp 192.0.2.245 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.114"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.114", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.68", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv4 unicast", "neighbor 192.0.2.114 activate", "neighbor 192.0.2.114 send-community both", "exit-address-family", "clear ip bgp 192.0.2.114 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.179"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.179", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.116", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "ok"}], "cli_fix": ["router bgp 65001", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.179 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.25"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.25", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "ok"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.4", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "ok"}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.25 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.95"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.95", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.23", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65010", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.95 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.144"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.144", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.101", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "ok"}], "cli_fix": ["ip route 172.16.5.0 255.255.255.0 192.0.2.254", "router bgp 65100", "clear ip bgp 192.0.2.144 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.185"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.185", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.89", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv4 unicast", "neighbor 192.0.2.185 activate", "neighbor 192.0.2.185 send-community both", "exit-address-family", "clear ip bgp 192.0.2.185 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.59"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.59", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.47", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.59 next-hop-self", "clear ip bgp 192.0.2.59 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.36"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.36", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.237", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.36 next-hop-self all", "clear ip bgp 192.0.2.36 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.151"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.151", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.189", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.151 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.152"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.152", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.200", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["ip route 10.10.0.0 255.255.0.0 192.0.2.254", "router bgp 65010", "clear ip bgp 192.0.2.152 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.119"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.119", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.104", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv6 unicast", "neighbor 192.0.2.119 activate", "neighbor 192.0.2.119 send-community both", "exit-address-family", "clear ip bgp 192.0.2.119 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.136"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.136", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.155", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv6 unicast", "neighbor 192.0.2.136 activate", "neighbor 192.0.2.136 send-community both", "exit-address-family", "clear ip bgp 192.0.2.136 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.90"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.90", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.236", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65001", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.90 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.150"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.150", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.80", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "ok"}], "cli_fix": ["router bgp 65002", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.150 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.170"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.170", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.158", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65001", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.170 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.65"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.65", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.194", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.65 next-hop-self all", "clear ip bgp 192.0.2.65 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.61"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.61", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.97", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv4 unicast", "neighbor 192.0.2.61 activate", "neighbor 192.0.2.61 send-community both", "exit-address-family", "clear ip bgp 192.0.2.61 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.77"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.77", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "ok"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.138", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 10.0.0.1", "router bgp 65002", "clear ip bgp 192.0.2.77 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.165"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.165", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.239", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "none"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.165 activate", "neighbor 192.0.2.165 send-community both", "exit-address-family", "clear ip bgp 192.0.2.165 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.167"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.167", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.22", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.167 next-hop-self", "clear ip bgp 192.0.2.167 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.170"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.170", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.7", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}], "cli_fix": ["ip route 10.10.0.0 255.255.0.0 198.51.100.2", "router bgp 65100", "clear ip bgp 192.0.2.170 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.247"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.247", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.182", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.247 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.168"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.168", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.206", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.168 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.94"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.94", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.6", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.94 next-hop-self", "clear ip bgp 192.0.2.94 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.129"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.129", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.235", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv4 unicast", "neighbor 192.0.2.129 activate", "exit-address-family", "clear ip bgp 192.0.2.129 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.128"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.128", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.45", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "ok"}], "cli_fix": ["router bgp 65001", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.128 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.121"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.121", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.144", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 192.0.2.254", "router bgp 65100", "clear ip bgp 192.0.2.121 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.165"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.165", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.10", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.165 activate", "exit-address-family", "clear ip bgp 192.0.2.165 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.193"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.193", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.63", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.193 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.27"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.27", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.58", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.27 activate", "exit-address-family", "clear ip bgp 192.0.2.27 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.58"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.58", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.188", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "none"}], "cli_fix": ["router bgp 65010", "address-family ipv6 unicast", "neighbor 192.0.2.58 activate", "exit-address-family", "clear ip bgp 192.0.2.58 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.22"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.22", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.128", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "none"}], "cli_fix": ["router bgp 65010", "address-family ipv6 unicast", "neighbor 192.0.2.22 activate", "exit-address-family", "clear ip bgp 192.0.2.22 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.96"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.96", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.199", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 192.0.2.254", "router bgp 65001", "clear ip bgp 192.0.2.96 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.206"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.206", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.171", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.206 next-hop-self all", "clear ip bgp 192.0.2.206 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.159"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.159", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.25", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.159 next-hop-self all", "clear ip bgp 192.0.2.159 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.30"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.30", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.80", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.30 next-hop-self all", "clear ip bgp 192.0.2.30 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.59"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.59", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.119", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.59 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.36"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.36", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.221", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65100", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.36 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.76"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.76", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.127", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65010", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.76 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.94"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.94", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.28", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv6 unicast", "neighbor 192.0.2.94 activate", "neighbor 192.0.2.94 send-community both", "exit-address-family", "clear ip bgp 192.0.2.94 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.156"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.156", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.70", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "ok"}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.156 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.21"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.21", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.167", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", "neighbor 192.0.2.21 activate", "exit-address-family", "clear ip bgp 192.0.2.21 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.215"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.215", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.172", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.215 next-hop-self", "clear ip bgp 192.0.2.215 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.104"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.104", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.20", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.104 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.105"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.105", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.29", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "none"}], "cli_fix": ["router bgp 65010", "address-family ipv6 unicast", "neighbor 192.0.2.105 activate", "exit-address-family", "clear ip bgp 192.0.2.105 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.7"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.7", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.97", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.7 next-hop-self all", "clear ip bgp 192.0.2.7 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.218"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.218", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.241", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65002", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.218 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.66"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.66", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "ok"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.83", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65010", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.66 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.103"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.103", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "ok"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.58", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["ip route 172.16.5.0 255.255.255.0 198.51.100.2", "router bgp 65002", "clear ip bgp 192.0.2.103 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.51"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.51", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.200", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "none"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.51 activate", "neighbor 192.0.2.51 send-community both", "exit-address-family", "clear ip bgp 192.0.2.51 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.180"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.180", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.224", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["router bgp 65100", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.180 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.179"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.179", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "ok"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.10", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "ok"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.179 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.37"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.37", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.100", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.37 activate", "exit-address-family", "clear ip bgp 192.0.2.37 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.10"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.10", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "ok"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.235", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "ok"}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.10 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.20"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.20", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.131", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv6 unicast", "neighbor 192.0.2.20 activate", "exit-address-family", "clear ip bgp 192.0.2.20 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.143"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.143", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.64", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}], "cli_fix": ["ip route 10.10.0.0 255.255.0.0 192.0.2.254", "router bgp 65010", "clear ip bgp 192.0.2.143 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.113"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.113", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.2", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.113 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.185"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.185", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.175", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 198.51.100.2", "router bgp 65010", "clear ip bgp 192.0.2.185 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.205"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.205", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.83", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.205 next-hop-self", "clear ip bgp 192.0.2.205 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.122"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.122", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.223", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "ok"}], "cli_fix": ["ip route 172.16.5.0 255.255.255.0 192.0.2.254", "router bgp 65010", "clear ip bgp 192.0.2.122 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.131"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.131", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.205", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "ok"}], "cli_fix": ["router bgp 65100", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.131 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.171"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.171", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "ok"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.116", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "ok"}], "cli_fix": ["router bgp 65001", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.171 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.119"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.119", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.217", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", "neighbor 192.0.2.119 activate", "exit-address-family", "clear ip bgp 192.0.2.119 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.237"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.237", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.95", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.237 next-hop-self all", "clear ip bgp 192.0.2.237 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.47"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.47", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.213", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv4 unicast", "neighbor 192.0.2.47 activate", "neighbor 192.0.2.47 send-community both", "exit-address-family", "clear ip bgp 192.0.2.47 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.202"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.202", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.135", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "none"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.202 activate", "exit-address-family", "clear ip bgp 192.0.2.202 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.190"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.190", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.227", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv6 unicast", "neighbor 192.0.2.190 activate", "exit-address-family", "clear ip bgp 192.0.2.190 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.89"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.89", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.87", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.89 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.246"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.246", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.171", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.246 next-hop-self all", "clear ip bgp 192.0.2.246 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.152"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.152", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.242", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["ip route 10.10.0.0 255.255.0.0 10.0.0.1", "router bgp 65001", "clear ip bgp 192.0.2.152 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.60"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.60", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.10", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "ok"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.60 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.222"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.222", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.115", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65100", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.222 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.84"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.84", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.201", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "ok"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.84 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.162"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.162", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.123", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv4 unicast", "neighbor 192.0.2.162 activate", "exit-address-family", "clear ip bgp 192.0.2.162 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.206"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.206", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.117", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.206 next-hop-self", "clear ip bgp 192.0.2.206 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.171"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.171", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.163", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.171 next-hop-self", "clear ip bgp 192.0.2.171 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.110"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.110", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.7", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.110 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.183"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.183", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.175", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.183 next-hop-self", "clear ip bgp 192.0.2.183 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.174"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.174", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.44", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv4 unicast", "neighbor 192.0.2.174 activate", "exit-address-family", "clear ip bgp 192.0.2.174 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.207"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.207", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.208", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", "neighbor 192.0.2.207 activate", "neighbor 192.0.2.207 send-community both", "exit-address-family", "clear ip bgp 192.0.2.207 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.124"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.124", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.215", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.124 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.147"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.147", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.65", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "none"}], "cli_fix": ["router bgp 65100", "address-family ipv6 unicast", "neighbor 192.0.2.147 activate", "neighbor 192.0.2.147 send-community both", "exit-address-family", "clear ip bgp 192.0.2.147 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.35"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.35", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.10", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.35 next-hop-self", "clear ip bgp 192.0.2.35 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.243"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.243", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.227", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", "neighbor 192.0.2.243 activate", "neighbor 192.0.2.243 send-community both", "exit-address-family", "clear ip bgp 192.0.2.243 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.154"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.154", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.251", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.154 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.2"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.2", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.136", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", "neighbor 192.0.2.2 activate", "exit-address-family", "clear ip bgp 192.0.2.2 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.14"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.14", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.63", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.14 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.98"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.98", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.117", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "none"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", "neighbor 192.0.2.98 activate", "neighbor 192.0.2.98 send-community both", "exit-address-family", "clear ip bgp 192.0.2.98 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.81"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.81", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "ok"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.53", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65002", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.81 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.34"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.34", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.111", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", "neighbor 192.0.2.34 activate", "neighbor 192.0.2.34 send-community both", "exit-address-family", "clear ip bgp 192.0.2.34 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.177"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.177", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.229", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["ip route 172.16.5.0 255.255.255.0 192.0.2.254", "router bgp 65100", "clear ip bgp 192.0.2.177 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.65"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.65", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.84", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv6 unicast", "neighbor 192.0.2.65 activate", "neighbor 192.0.2.65 send-community both", "exit-address-family", "clear ip bgp 192.0.2.65 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.29"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.29", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.144", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.29 next-hop-self all", "clear ip bgp 192.0.2.29 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.168"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.168", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.241", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.168 next-hop-self", "clear ip bgp 192.0.2.168 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.156"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.156", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.104", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.156 next-hop-self", "clear ip bgp 192.0.2.156 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.47"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.47", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.212", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.47 next-hop-self", "clear ip bgp 192.0.2.47 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.138"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.138", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.179", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.138 next-hop-self", "clear ip bgp 192.0.2.138 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.208"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.208", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.78", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65010", "address-family ipv6 unicast", "neighbor 192.0.2.208 activate", "exit-address-family", "clear ip bgp 192.0.2.208 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.103"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.103", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.91", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.103 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.87"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.87", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.213", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65002", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.87 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.239"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.239", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.25", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", "neighbor 192.0.2.239 activate", "exit-address-family", "clear ip bgp 192.0.2.239 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.119"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.119", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.37", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["router bgp 65002", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.119 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.164"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.164", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.75", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "ok"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.164 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.166"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.166", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.146", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.166 next-hop-self all", "clear ip bgp 192.0.2.166 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.43"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.43", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.191", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv4 unicast", "neighbor 192.0.2.43 activate", "exit-address-family", "clear ip bgp 192.0.2.43 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.197"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.197", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.24", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}], "cli_fix": ["router bgp 65010", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.197 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.77"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.77", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.55", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv4 unicast", "neighbor 192.0.2.77 activate", "exit-address-family", "clear ip bgp 192.0.2.77 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.46"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.46", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.254", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.46 next-hop-self", "clear ip bgp 192.0.2.46 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.131"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.131", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.26", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.131 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.13"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.13", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.254", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv4 unicast", "neighbor 192.0.2.13 activate", "exit-address-family", "clear ip bgp 192.0.2.13 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.178"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.178", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.174", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 192.0.2.254", "router bgp 65100", "clear ip bgp 192.0.2.178 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.184"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.184", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "ok"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.87", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["router bgp 65010", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.184 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.140"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.140", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.167", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.140 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.17"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.17", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.134", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.17 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.118"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.118", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.190", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", "neighbor 192.0.2.118 activate", "neighbor 192.0.2.118 send-community both", "exit-address-family", "clear ip bgp 192.0.2.118 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.234"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.234", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.206", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.234 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.151"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.151", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.249", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", "neighbor 192.0.2.151 activate", "exit-address-family", "clear ip bgp 192.0.2.151 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.164"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.164", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.115", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.164 next-hop-self all", "clear ip bgp 192.0.2.164 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.207"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.207", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.88", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.207 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.250"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.250", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.70", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", "neighbor 192.0.2.250 activate", "neighbor 192.0.2.250 send-community both", "exit-address-family", "clear ip bgp 192.0.2.250 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.122"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.122", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.211", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}], "cli_fix": ["router bgp 65001", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.122 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.41"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.41", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "ok"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.139", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.41 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.236"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.236", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.131", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "ok"}], "cli_fix": ["ip route 172.16.5.0 255.255.255.0 198.51.100.2", "router bgp 65100", "clear ip bgp 192.0.2.236 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.195"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.195", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.211", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65010", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.195 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.243"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.243", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.21", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.243 activate", "exit-address-family", "clear ip bgp 192.0.2.243 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.20"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.20", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.37", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.20 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.165"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.165", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.51", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv4 unicast", "neighbor 192.0.2.165 activate", "neighbor 192.0.2.165 send-community both", "exit-address-family", "clear ip bgp 192.0.2.165 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.40"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.40", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.89", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", "neighbor 192.0.2.40 activate", "exit-address-family", "clear ip bgp 192.0.2.40 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.41"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.41", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.227", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "ok"}], "cli_fix": ["router bgp 65100", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.41 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.217"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.217", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.132", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.217 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.43"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.43", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.1", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.43 next-hop-self", "clear ip bgp 192.0.2.43 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.82"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.82", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.174", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.82 next-hop-self", "clear ip bgp 192.0.2.82 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.254"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.254", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.173", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.254 activate", "neighbor 192.0.2.254 send-community both", "exit-address-family", "clear ip bgp 192.0.2.254 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.158"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.158", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.93", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv4 unicast", "neighbor 192.0.2.158 activate", "neighbor 192.0.2.158 send-community both", "exit-address-family", "clear ip bgp 192.0.2.158 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.183"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.183", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.144", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.183 next-hop-self all", "clear ip bgp 192.0.2.183 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.227"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.227", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.170", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv4 unicast", "neighbor 192.0.2.227 activate", "exit-address-family", "clear ip bgp 192.0.2.227 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.35"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.35", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.11", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65100", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.35 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.215"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.215", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.170", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.215 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.188"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.188", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.207", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", "neighbor 192.0.2.188 activate", "exit-address-family", "clear ip bgp 192.0.2.188 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.105"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.105", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.140", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.105 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.52"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.52", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.132", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.52 next-hop-self all", "clear ip bgp 192.0.2.52 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.130"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.130", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.223", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.130 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.165"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.165", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.92", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65001", "address-family ipv4 unicast", "neighbor 192.0.2.165 activate", "exit-address-family", "clear ip bgp 192.0.2.165 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.149"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.149", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.6", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.149 activate", "exit-address-family", "clear ip bgp 192.0.2.149 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.9"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.9", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.107", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.9 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.204"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.204", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "ok"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.123", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["ip route 172.16.5.0 255.255.255.0 192.0.2.254", "router bgp 65002", "clear ip bgp 192.0.2.204 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.128"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.128", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.180", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.128 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.70"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.70", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.29", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 192.0.2.254", "router bgp 65100", "clear ip bgp 192.0.2.70 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.64"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.64", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "ok"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.109", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65010", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.64 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.142"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.142", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.184", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", "neighbor 192.0.2.142 activate", "neighbor 192.0.2.142 send-community both", "exit-address-family", "clear ip bgp 192.0.2.142 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.125"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.125", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.25", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.125 next-hop-self", "clear ip bgp 192.0.2.125 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.63"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.63", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.170", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.63 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.95"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.95", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.78", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.95 next-hop-self all", "clear ip bgp 192.0.2.95 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.168"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.168", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.87", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.168 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.100"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.100", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "ok"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.28", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "ok"}], "cli_fix": ["router bgp 65100", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.100 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.132"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.132", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.238", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv6 unicast", "neighbor 192.0.2.132 activate", "neighbor 192.0.2.132 send-community both", "exit-address-family", "clear ip bgp 192.0.2.132 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.30"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.30", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.61", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "none"}], "cli_fix": ["router bgp 65100", "address-family ipv4 unicast", "neighbor 192.0.2.30 activate", "neighbor 192.0.2.30 send-community both", "exit-address-family", "clear ip bgp 192.0.2.30 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.205"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.205", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.80", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv4 unicast", "neighbor 192.0.2.205 activate", "neighbor 192.0.2.205 send-community both", "exit-address-family", "clear ip bgp 192.0.2.205 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.19"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.19", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.232", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.19 next-hop-self", "clear ip bgp 192.0.2.19 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.54"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.54", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.141", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.54 next-hop-self all", "clear ip bgp 192.0.2.54 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.63"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.63", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.227", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65100", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.63 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.191"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.191", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.181", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65100", "address-family ipv4 unicast", "neighbor 192.0.2.191 activate", "neighbor 192.0.2.191 send-community both", "exit-address-family", "clear ip bgp 192.0.2.191 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.245"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.245", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.134", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv4 unicast", "neighbor 192.0.2.245 activate", "exit-address-family", "clear ip bgp 192.0.2.245 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.37"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.37", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.14", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.37 next-hop-self", "clear ip bgp 192.0.2.37 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.38"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.38", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.75", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.38 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.228"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.228", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.21", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.228 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.156"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.156", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.204", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.156 next-hop-self", "clear ip bgp 192.0.2.156 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.248"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.248", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.201", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["router bgp 65002", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.248 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.246"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.246", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.141", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.246 next-hop-self", "clear ip bgp 192.0.2.246 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.65"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.65", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.176", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 10.0.0.1", "router bgp 65001", "clear ip bgp 192.0.2.65 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.87"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.87", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "ok"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.30", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}], "cli_fix": ["ip route 172.16.5.0 255.255.255.0 10.0.0.1", "router bgp 65010", "clear ip bgp 192.0.2.87 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.4"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.4", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.186", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "ok"}], "cli_fix": ["ip route 10.10.0.0 255.255.0.0 192.0.2.254", "router bgp 65100", "clear ip bgp 192.0.2.4 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.137"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.137", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.215", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65002", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.137 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.200"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.200", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.242", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv4 unicast", "neighbor 192.0.2.200 activate", "neighbor 192.0.2.200 send-community both", "exit-address-family", "clear ip bgp 192.0.2.200 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.192"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.192", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.204", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.192 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.125"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.125", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.90", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.125 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.136"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.136", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.157", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "ok"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 10.0.0.1", "router bgp 65001", "clear ip bgp 192.0.2.136 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.231"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.231", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "ok"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.1", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.231 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.35"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.35", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.55", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 10.0.0.1", "router bgp 65100", "clear ip bgp 192.0.2.35 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.232"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.232", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.204", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.232 next-hop-self all", "clear ip bgp 192.0.2.232 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.35"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.35", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "ok"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.32", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}], "cli_fix": ["ip route 172.16.5.0 255.255.255.0 10.0.0.1", "router bgp 65001", "clear ip bgp 192.0.2.35 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.73"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.73", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.250", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}], "cli_fix": ["ip route 172.16.5.0 255.255.255.0 192.0.2.254", "router bgp 65010", "clear ip bgp 192.0.2.73 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.239"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.239", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.194", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv6 unicast", "neighbor 192.0.2.239 activate", "exit-address-family", "clear ip bgp 192.0.2.239 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.154"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.154", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "ok"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.49", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "ok"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.154 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.176"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.176", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.101", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.176 next-hop-self", "clear ip bgp 192.0.2.176 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.206"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.206", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.192", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv6 unicast", "neighbor 192.0.2.206 activate", "neighbor 192.0.2.206 send-community both", "exit-address-family", "clear ip bgp 192.0.2.206 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.240"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.240", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.128", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65100", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.240 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.35"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.35", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.156", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", "neighbor 192.0.2.35 activate", "neighbor 192.0.2.35 send-community both", "exit-address-family", "clear ip bgp 192.0.2.35 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.214"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.214", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.5", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.214 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.4"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.4", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.187", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv4 unicast", "neighbor 192.0.2.4 activate", "neighbor 192.0.2.4 send-community both", "exit-address-family", "clear ip bgp 192.0.2.4 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.171"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.171", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.169", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.171 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.185"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.185", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.75", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.185 next-hop-self", "clear ip bgp 192.0.2.185 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.75"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.75", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "ok"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.173", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.75 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.144"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.144", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.154", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv4 unicast", "neighbor 192.0.2.144 activate", "neighbor 192.0.2.144 send-community both", "exit-address-family", "clear ip bgp 192.0.2.144 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.148"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.148", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.143", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65100", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.148 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.83"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.83", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.220", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.83 next-hop-self", "clear ip bgp 192.0.2.83 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.20"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.20", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.72", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.20 next-hop-self all", "clear ip bgp 192.0.2.20 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.231"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.231", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.50", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.231 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.67"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.67", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "ok"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.203", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}], "cli_fix": ["ip route 172.16.5.0 255.255.255.0 198.51.100.2", "router bgp 65002", "clear ip bgp 192.0.2.67 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.173"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.173", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.77", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "none"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", "neighbor 192.0.2.173 activate", "neighbor 192.0.2.173 send-community both", "exit-address-family", "clear ip bgp 192.0.2.173 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.155"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.155", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.237", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.155 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.14"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.14", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.193", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.14 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.237"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.237", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.119", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv4 unicast", "neighbor 192.0.2.237 activate", "exit-address-family", "clear ip bgp 192.0.2.237 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.76"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.76", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.12", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65100", "address-family ipv4 unicast", "neighbor 192.0.2.76 activate", "neighbor 192.0.2.76 send-community both", "exit-address-family", "clear ip bgp 192.0.2.76 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.99"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.99", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.14", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 198.51.100.2", "router bgp 65010", "clear ip bgp 192.0.2.99 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.216"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.216", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.254", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.216 next-hop-self all", "clear ip bgp 192.0.2.216 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.157"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.157", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.175", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 198.51.100.2", "router bgp 65100", "clear ip bgp 192.0.2.157 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.60"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.60", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.46", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.60 next-hop-self all", "clear ip bgp 192.0.2.60 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.21"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.21", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.162", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.21 next-hop-self all", "clear ip bgp 192.0.2.21 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.124"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.124", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.94", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "ok"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.124 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.200"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.200", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "ok"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.146", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65001", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.200 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.63"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.63", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.32", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv4 unicast", "neighbor 192.0.2.63 activate", "exit-address-family", "clear ip bgp 192.0.2.63 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.241"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.241", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.57", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.241 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.230"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.230", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.154", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.230 next-hop-self all", "clear ip bgp 192.0.2.230 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.101"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.101", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.203", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "ok"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 192.0.2.254", "router bgp 65010", "clear ip bgp 192.0.2.101 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.153"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.153", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.44", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}], "cli_fix": ["router bgp 65100", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.153 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.80"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.80", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.68", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.80 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.124"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.124", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.213", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.124 next-hop-self all", "clear ip bgp 192.0.2.124 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.122"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.122", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.116", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.122 next-hop-self all", "clear ip bgp 192.0.2.122 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.130"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.130", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.187", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}], "cli_fix": ["ip route 10.10.0.0 255.255.0.0 198.51.100.2", "router bgp 65100", "clear ip bgp 192.0.2.130 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.226"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.226", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.93", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "none"}], "cli_fix": ["router bgp 65010", "address-family ipv4 unicast", "neighbor 192.0.2.226 activate", "exit-address-family", "clear ip bgp 192.0.2.226 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.86"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.86", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.240", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65001", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.86 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.251"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.251", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.136", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "ok"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 192.0.2.254", "router bgp 65001", "clear ip bgp 192.0.2.251 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.145"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.145", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.42", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.145 next-hop-self all", "clear ip bgp 192.0.2.145 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.189"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.189", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.180", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65100", "address-family ipv6 unicast", "neighbor 192.0.2.189 activate", "exit-address-family", "clear ip bgp 192.0.2.189 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.24"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.24", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "ok"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.43", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.24 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.117"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.117", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "ok"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.74", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.117 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.79"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.79", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.154", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv4 unicast", "neighbor 192.0.2.79 activate", "exit-address-family", "clear ip bgp 192.0.2.79 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.152"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.152", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.57", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}], "cli_fix": ["ip route 10.10.0.0 255.255.0.0 198.51.100.2", "router bgp 65010", "clear ip bgp 192.0.2.152 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.137"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.137", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.86", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", "neighbor 192.0.2.137 activate", "neighbor 192.0.2.137 send-community both", "exit-address-family", "clear ip bgp 192.0.2.137 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.110"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.110", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.89", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.110 next-hop-self", "clear ip bgp 192.0.2.110 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.191"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.191", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.26", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.191 next-hop-self all", "clear ip bgp 192.0.2.191 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.232"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.232", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.178", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", "neighbor 192.0.2.232 activate", "neighbor 192.0.2.232 send-community both", "exit-address-family", "clear ip bgp 192.0.2.232 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.217"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.217", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.186", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.217 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.152"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.152", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.24", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 192.0.2.254", "router bgp 65002", "clear ip bgp 192.0.2.152 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.131"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.131", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.140", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv6 unicast", "neighbor 192.0.2.131 activate", "exit-address-family", "clear ip bgp 192.0.2.131 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.187"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.187", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.214", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.187 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.128"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.128", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.117", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.128 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.33"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.33", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.181", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.33 next-hop-self all", "clear ip bgp 192.0.2.33 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.171"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.171", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "ok"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.64", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "ok"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.171 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.63"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.63", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "ok"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.250", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["ip route 172.16.5.0 255.255.255.0 198.51.100.2", "router bgp 65010", "clear ip bgp 192.0.2.63 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.54"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.54", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.68", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.54 next-hop-self all", "clear ip bgp 192.0.2.54 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.68"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.68", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.172", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "none"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", "neighbor 192.0.2.68 activate", "neighbor 192.0.2.68 send-community both", "exit-address-family", "clear ip bgp 192.0.2.68 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.203"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.203", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.15", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["ip route 10.10.0.0 255.255.0.0 10.0.0.1", "router bgp 65010", "clear ip bgp 192.0.2.203 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.19"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.19", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.163", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.19 next-hop-self", "clear ip bgp 192.0.2.19 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.15"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.15", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "ok"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.7", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.15 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.60"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.60", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "ok"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.183", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["router bgp 65002", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.60 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.57"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.57", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.107", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", "neighbor 192.0.2.57 activate", "exit-address-family", "clear ip bgp 192.0.2.57 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.18"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.18", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "ok"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.252", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["ip route 10.10.0.0 255.255.0.0 198.51.100.2", "router bgp 65001", "clear ip bgp 192.0.2.18 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.8"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.8", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.56", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.8 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.129"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.129", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.37", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv4 unicast", "neighbor 192.0.2.129 activate", "exit-address-family", "clear ip bgp 192.0.2.129 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.93"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.93", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.186", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.93 next-hop-self all", "clear ip bgp 192.0.2.93 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.56"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.56", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.127", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.56 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.125"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.125", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.50", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.125 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.136"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.136", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.25", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.136 next-hop-self all", "clear ip bgp 192.0.2.136 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.94"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.94", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.192", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 192.0.2.254", "router bgp 65002", "clear ip bgp 192.0.2.94 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.89"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.89", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.51", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "none"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", "neighbor 192.0.2.89 activate", "exit-address-family", "clear ip bgp 192.0.2.89 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.143"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.143", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.227", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv4 unicast", "neighbor 192.0.2.143 activate", "exit-address-family", "clear ip bgp 192.0.2.143 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.22"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.22", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "ok"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.35", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "ok"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.22 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.161"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.161", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.218", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv4 unicast", "neighbor 192.0.2.161 activate", "neighbor 192.0.2.161 send-community both", "exit-address-family", "clear ip bgp 192.0.2.161 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.121"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.121", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "ok"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.8", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.121 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.168"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.168", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.205", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.168 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.98"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.98", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.89", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", "neighbor 192.0.2.98 activate", "exit-address-family", "clear ip bgp 192.0.2.98 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.137"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.137", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.238", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.137 next-hop-self", "clear ip bgp 192.0.2.137 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.214"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.214", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.10", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}], "cli_fix": ["ip route 10.10.0.0 255.255.0.0 192.0.2.254", "router bgp 65001", "clear ip bgp 192.0.2.214 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.215"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.215", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.132", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", "neighbor 192.0.2.215 activate", "exit-address-family", "clear ip bgp 192.0.2.215 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.15"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.15", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.56", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv4 unicast", "neighbor 192.0.2.15 activate", "neighbor 192.0.2.15 send-community both", "exit-address-family", "clear ip bgp 192.0.2.15 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.203"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.203", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.56", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.203 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.34"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.34", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.246", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.34 next-hop-self", "clear ip bgp 192.0.2.34 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.246"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.246", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.154", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv4 unicast", "neighbor 192.0.2.246 activate", "neighbor 192.0.2.246 send-community both", "exit-address-family", "clear ip bgp 192.0.2.246 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.162"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.162", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.165", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.162 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.60"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.60", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.207", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.60 next-hop-self", "clear ip bgp 192.0.2.60 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.108"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.108", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.196", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.108 next-hop-self all", "clear ip bgp 192.0.2.108 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.159"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.159", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.188", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65002", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.159 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.68"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.68", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.154", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.68 next-hop-self", "clear ip bgp 192.0.2.68 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.114"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.114", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.199", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv4 unicast", "neighbor 192.0.2.114 activate", "exit-address-family", "clear ip bgp 192.0.2.114 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.99"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.99", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.144", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.99 next-hop-self all", "clear ip bgp 192.0.2.99 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.72"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.72", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.105", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.72 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.248"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.248", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.12", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", "neighbor 192.0.2.248 activate", "neighbor 192.0.2.248 send-community both", "exit-address-family", "clear ip bgp 192.0.2.248 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.8"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.8", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.131", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "none"}], "cli_fix": ["router bgp 65010", "address-family ipv4 unicast", "neighbor 192.0.2.8 activate", "exit-address-family", "clear ip bgp 192.0.2.8 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.224"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.224", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.104", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["ip route 172.16.5.0 255.255.255.0 198.51.100.2", "router bgp 65001", "clear ip bgp 192.0.2.224 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.191"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.191", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.38", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "none"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", "neighbor 192.0.2.191 activate", "neighbor 192.0.2.191 send-community both", "exit-address-family", "clear ip bgp 192.0.2.191 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.118"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.118", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.133", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv6 unicast", "neighbor 192.0.2.118 activate", "neighbor 192.0.2.118 send-community both", "exit-address-family", "clear ip bgp 192.0.2.118 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.137"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.137", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.152", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv4 unicast", "neighbor 192.0.2.137 activate", "exit-address-family", "clear ip bgp 192.0.2.137 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.95"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.95", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.243", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.95 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.154"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.154", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.234", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65010", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.154 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.201"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.201", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.78", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv6 unicast", "neighbor 192.0.2.201 activate", "exit-address-family", "clear ip bgp 192.0.2.201 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.251"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.251", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.42", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65100", "address-family ipv6 unicast", "neighbor 192.0.2.251 activate", "neighbor 192.0.2.251 send-community both", "exit-address-family", "clear ip bgp 192.0.2.251 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.222"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.222", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "ok"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.229", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "ok"}], "cli_fix": ["ip route 10.10.0.0 255.255.0.0 198.51.100.2", "router bgp 65010", "clear ip bgp 192.0.2.222 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.61"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.61", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.159", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.61 next-hop-self", "clear ip bgp 192.0.2.61 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.69"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.69", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.16", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv4 unicast", "neighbor 192.0.2.69 activate", "neighbor 192.0.2.69 send-community both", "exit-address-family", "clear ip bgp 192.0.2.69 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.21"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.21", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.119", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65002", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.21 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.216"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.216", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.186", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.216 next-hop-self all", "clear ip bgp 192.0.2.216 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.148"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.148", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.153", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.148 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.207"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.207", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "ok"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.211", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65001", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.207 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.189"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.189", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.13", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 10.0.0.1", "router bgp 65100", "clear ip bgp 192.0.2.189 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.135"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.135", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.78", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.135 next-hop-self", "clear ip bgp 192.0.2.135 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.23"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.23", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.37", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.23 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.198"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.198", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.227", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", "neighbor 192.0.2.198 activate", "exit-address-family", "clear ip bgp 192.0.2.198 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.218"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.218", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.69", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.218 next-hop-self all", "clear ip bgp 192.0.2.218 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.219"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.219", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.165", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.219 next-hop-self", "clear ip bgp 192.0.2.219 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.228"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.228", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.169", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.228 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.147"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.147", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.201", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}], "cli_fix": ["ip route 172.16.5.0 255.255.255.0 10.0.0.1", "router bgp 65100", "clear ip bgp 192.0.2.147 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.56"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.56", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.155", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.56 next-hop-self", "clear ip bgp 192.0.2.56 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.126"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.126", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.61", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.126 next-hop-self", "clear ip bgp 192.0.2.126 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.33"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.33", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.75", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.33 activate", "exit-address-family", "clear ip bgp 192.0.2.33 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.188"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.188", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "ok"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.28", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65002", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.188 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.101"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.101", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.73", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 198.51.100.2", "router bgp 65100", "clear ip bgp 192.0.2.101 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.134"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.134", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "ok"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.241", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "ok"}], "cli_fix": ["router bgp 65002", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.134 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.107"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.107", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.52", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.107 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.183"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.183", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.161", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv4 unicast", "neighbor 192.0.2.183 activate", "neighbor 192.0.2.183 send-community both", "exit-address-family", "clear ip bgp 192.0.2.183 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.218"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.218", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.213", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.218 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.49"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.49", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.181", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv6 unicast", "neighbor 192.0.2.49 activate", "neighbor 192.0.2.49 send-community both", "exit-address-family", "clear ip bgp 192.0.2.49 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.182"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.182", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.94", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.182 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.130"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.130", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.218", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv6 unicast", "neighbor 192.0.2.130 activate", "exit-address-family", "clear ip bgp 192.0.2.130 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.2"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.2", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.157", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.2 activate", "exit-address-family", "clear ip bgp 192.0.2.2 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.234"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.234", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "ok"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.57", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["ip route 10.10.0.0 255.255.0.0 192.0.2.254", "router bgp 65100", "clear ip bgp 192.0.2.234 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.78"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.78", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.83", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.78 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.229"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.229", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.11", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.229 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.96"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.96", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.146", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", "neighbor 192.0.2.96 activate", "neighbor 192.0.2.96 send-community both", "exit-address-family", "clear ip bgp 192.0.2.96 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.184"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.184", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.38", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv6 unicast", "neighbor 192.0.2.184 activate", "exit-address-family", "clear ip bgp 192.0.2.184 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.207"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.207", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.36", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.207 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.172"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.172", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.22", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.172 next-hop-self all", "clear ip bgp 192.0.2.172 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.63"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.63", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.12", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", "neighbor 192.0.2.63 activate", "exit-address-family", "clear ip bgp 192.0.2.63 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.15"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.15", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.232", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.15 next-hop-self", "clear ip bgp 192.0.2.15 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.53"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.53", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.234", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.53 next-hop-self all", "clear ip bgp 192.0.2.53 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.168"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.168", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.218", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.168 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.126"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.126", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.6", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.126 next-hop-self all", "clear ip bgp 192.0.2.126 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.190"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.190", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.166", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["ip route 10.10.0.0 255.255.0.0 192.0.2.254", "router bgp 65002", "clear ip bgp 192.0.2.190 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.71"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.71", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.179", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.71 next-hop-self", "clear ip bgp 192.0.2.71 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.198"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.198", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.180", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 10.0.0.1", "router bgp 65002", "clear ip bgp 192.0.2.198 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.69"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.69", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.78", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.69 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.23"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.23", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.185", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}], "cli_fix": ["ip route 10.10.0.0 255.255.0.0 10.0.0.1", "router bgp 65100", "clear ip bgp 192.0.2.23 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.159"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.159", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.170", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.159 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.40"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.40", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.126", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["router bgp 65001", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.40 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.39"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.39", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.53", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.39 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.70"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.70", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.45", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv6 unicast", "neighbor 192.0.2.70 activate", "exit-address-family", "clear ip bgp 192.0.2.70 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.116"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.116", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.119", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.116 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.174"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.174", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.66", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.174 activate", "neighbor 192.0.2.174 send-community both", "exit-address-family", "clear ip bgp 192.0.2.174 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.190"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.190", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.14", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.190 activate", "exit-address-family", "clear ip bgp 192.0.2.190 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.50"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.50", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.78", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", "neighbor 192.0.2.50 activate", "exit-address-family", "clear ip bgp 192.0.2.50 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.197"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.197", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.154", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.197 activate", "exit-address-family", "clear ip bgp 192.0.2.197 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.166"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.166", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.106", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.166 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.220"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.220", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.21", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.220 next-hop-self all", "clear ip bgp 192.0.2.220 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.127"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.127", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "ok"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.135", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "ok"}], "cli_fix": ["router bgp 65001", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.127 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.230"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.230", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.161", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.230 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.56"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.56", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.213", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.56 next-hop-self all", "clear ip bgp 192.0.2.56 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.249"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.249", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.106", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv6 unicast", "neighbor 192.0.2.249 activate", "exit-address-family", "clear ip bgp 192.0.2.249 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.128"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.128", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.189", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.128 next-hop-self", "clear ip bgp 192.0.2.128 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.20"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.20", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.203", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.20 next-hop-self all", "clear ip bgp 192.0.2.20 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.218"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.218", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.212", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.218 next-hop-self all", "clear ip bgp 192.0.2.218 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.198"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.198", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.185", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv4 unicast", "neighbor 192.0.2.198 activate", "exit-address-family", "clear ip bgp 192.0.2.198 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.166"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.166", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.116", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65002", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.166 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.246"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.246", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.89", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.246 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.40"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.40", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.68", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv4 unicast", "neighbor 192.0.2.40 activate", "neighbor 192.0.2.40 send-community both", "exit-address-family", "clear ip bgp 192.0.2.40 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.50"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.50", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.228", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "ok"}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.50 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.39"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.39", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "ok"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.14", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "ok"}], "cli_fix": ["router bgp 65010", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.39 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.192"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.192", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.231", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.192 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.129"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.129", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.65", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.129 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.235"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.235", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "ok"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.238", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 10.0.0.1", "router bgp 65010", "clear ip bgp 192.0.2.235 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.90"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.90", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.51", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.90 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.161"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.161", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.138", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "none"}], "cli_fix": ["router bgp 65010", "address-family ipv4 unicast", "neighbor 192.0.2.161 activate", "exit-address-family", "clear ip bgp 192.0.2.161 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.220"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.220", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.61", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.220 activate", "neighbor 192.0.2.220 send-community both", "exit-address-family", "clear ip bgp 192.0.2.220 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.47"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.47", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.187", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "none"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", "neighbor 192.0.2.47 activate", "neighbor 192.0.2.47 send-community both", "exit-address-family", "clear ip bgp 192.0.2.47 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.100"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.100", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.153", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv6 unicast", "neighbor 192.0.2.100 activate", "neighbor 192.0.2.100 send-community both", "exit-address-family", "clear ip bgp 192.0.2.100 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.219"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.219", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.1", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv4 unicast", "neighbor 192.0.2.219 activate", "exit-address-family", "clear ip bgp 192.0.2.219 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.46"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.46", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "ok"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.101", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "ok"}], "cli_fix": ["ip route 172.16.5.0 255.255.255.0 192.0.2.254", "router bgp 65100", "clear ip bgp 192.0.2.46 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.39"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.39", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.138", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.39 next-hop-self", "clear ip bgp 192.0.2.39 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.220"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.220", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.219", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.220 next-hop-self all", "clear ip bgp 192.0.2.220 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.125"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.125", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.97", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.125 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.176"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.176", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.162", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 192.0.2.254", "router bgp 65100", "clear ip bgp 192.0.2.176 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.30"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.30", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.104", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "ok"}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.30 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.201"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.201", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.32", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv6 unicast", "neighbor 192.0.2.201 activate", "neighbor 192.0.2.201 send-community both", "exit-address-family", "clear ip bgp 192.0.2.201 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.195"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.195", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.203", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 198.51.100.2", "router bgp 65010", "clear ip bgp 192.0.2.195 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.202"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.202", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.146", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", "neighbor 192.0.2.202 activate", "exit-address-family", "clear ip bgp 192.0.2.202 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.70"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.70", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.12", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.70 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.242"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.242", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.161", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", "neighbor 192.0.2.242 activate", "exit-address-family", "clear ip bgp 192.0.2.242 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.100"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.100", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.1", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.100 next-hop-self all", "clear ip bgp 192.0.2.100 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.88"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.88", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.89", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.88 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.33"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.33", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.157", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65001", "address-family ipv4 unicast", "neighbor 192.0.2.33 activate", "exit-address-family", "clear ip bgp 192.0.2.33 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.34"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.34", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.192", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.34 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.1"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.1", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.73", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["router bgp 65002", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.1 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.252"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.252", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.49", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", "neighbor 192.0.2.252 activate", "neighbor 192.0.2.252 send-community both", "exit-address-family", "clear ip bgp 192.0.2.252 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.145"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.145", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.92", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv6 unicast", "neighbor 192.0.2.145 activate", "neighbor 192.0.2.145 send-community both", "exit-address-family", "clear ip bgp 192.0.2.145 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.133"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.133", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.166", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.133 next-hop-self", "clear ip bgp 192.0.2.133 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.187"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.187", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.94", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv4 unicast", "neighbor 192.0.2.187 activate", "exit-address-family", "clear ip bgp 192.0.2.187 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.132"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.132", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.98", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.132 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.89"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.89", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.67", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.89 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.89"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.89", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.152", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.89 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.234"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.234", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.204", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv4 unicast", "neighbor 192.0.2.234 activate", "neighbor 192.0.2.234 send-community both", "exit-address-family", "clear ip bgp 192.0.2.234 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.87"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.87", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.181", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65010", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.87 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.58"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.58", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.164", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.58 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.77"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.77", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.214", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "ok"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.77 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.63"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.63", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.80", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "none"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.63 activate", "exit-address-family", "clear ip bgp 192.0.2.63 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.97"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.97", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.37", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["ip route 172.16.5.0 255.255.255.0 192.0.2.254", "router bgp 65010", "clear ip bgp 192.0.2.97 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.198"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.198", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.57", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "ok"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.198 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.35"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.35", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.28", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv6 unicast", "neighbor 192.0.2.35 activate", "exit-address-family", "clear ip bgp 192.0.2.35 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.217"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.217", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.61", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "none"}], "cli_fix": ["router bgp 65100", "address-family ipv4 unicast", "neighbor 192.0.2.217 activate", "neighbor 192.0.2.217 send-community both", "exit-address-family", "clear ip bgp 192.0.2.217 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.210"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.210", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.160", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.210 next-hop-self", "clear ip bgp 192.0.2.210 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.73"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.73", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.246", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.73 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.89"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.89", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.22", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.89 next-hop-self", "clear ip bgp 192.0.2.89 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.147"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.147", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.130", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["ip route 10.10.0.0 255.255.0.0 192.0.2.254", "router bgp 65010", "clear ip bgp 192.0.2.147 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.39"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.39", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.230", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv4 unicast", "neighbor 192.0.2.39 activate", "exit-address-family", "clear ip bgp 192.0.2.39 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.96"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.96", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.84", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 10.0.0.1", "router bgp 65010", "clear ip bgp 192.0.2.96 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.115"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.115", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.18", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "ok"}], "cli_fix": ["router bgp 65002", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.115 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.145"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.145", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "ok"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.161", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.145 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.140"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.140", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "ok"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.96", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "ok"}], "cli_fix": ["router bgp 65100", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.140 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.116"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.116", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.90", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "none"}], "cli_fix": ["router bgp 65010", "address-family ipv6 unicast", "neighbor 192.0.2.116 activate", "exit-address-family", "clear ip bgp 192.0.2.116 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.138"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.138", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.171", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.138 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.135"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.135", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.74", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.135 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.168"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.168", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.178", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", "neighbor 192.0.2.168 activate", "exit-address-family", "clear ip bgp 192.0.2.168 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.121"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.121", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.214", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.121 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.234"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.234", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.12", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 198.51.100.2", "router bgp 65010", "clear ip bgp 192.0.2.234 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.25"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.25", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.42", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.25 next-hop-self all", "clear ip bgp 192.0.2.25 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.128"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.128", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.93", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv6 unicast", "neighbor 192.0.2.128 activate", "neighbor 192.0.2.128 send-community both", "exit-address-family", "clear ip bgp 192.0.2.128 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.33"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.33", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.194", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}], "cli_fix": ["ip route 172.16.5.0 255.255.255.0 10.0.0.1", "router bgp 65010", "clear ip bgp 192.0.2.33 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.91"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.91", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.154", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["ip route 10.10.0.0 255.255.0.0 198.51.100.2", "router bgp 65001", "clear ip bgp 192.0.2.91 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.118"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.118", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.79", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65100", "address-family ipv6 unicast", "neighbor 192.0.2.118 activate", "exit-address-family", "clear ip bgp 192.0.2.118 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.79"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.79", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.158", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.79 next-hop-self all", "clear ip bgp 192.0.2.79 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.86"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.86", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.171", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "ok"}], "cli_fix": ["router bgp 65002", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.86 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.242"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.242", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.156", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "ok"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.242 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.227"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.227", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.188", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.227 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.116"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.116", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.194", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv4 unicast", "neighbor 192.0.2.116 activate", "exit-address-family", "clear ip bgp 192.0.2.116 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.167"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.167", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.133", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65002", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.167 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.20"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.20", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.47", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.20 next-hop-self", "clear ip bgp 192.0.2.20 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.232"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.232", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.101", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.232 next-hop-self all", "clear ip bgp 192.0.2.232 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.210"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.210", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.116", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "none"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.210 activate", "neighbor 192.0.2.210 send-community both", "exit-address-family", "clear ip bgp 192.0.2.210 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.246"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.246", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.67", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "none"}], "cli_fix": ["router bgp 65001", "address-family ipv4 unicast", "neighbor 192.0.2.246 activate", "neighbor 192.0.2.246 send-community both", "exit-address-family", "clear ip bgp 192.0.2.246 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.65"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.65", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.64", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.65 next-hop-self all", "clear ip bgp 192.0.2.65 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.21"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.21", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.15", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", "neighbor 192.0.2.21 activate", "neighbor 192.0.2.21 send-community both", "exit-address-family", "clear ip bgp 192.0.2.21 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.74"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.74", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.46", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv6 unicast", "neighbor 192.0.2.74 activate", "neighbor 192.0.2.74 send-community both", "exit-address-family", "clear ip bgp 192.0.2.74 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.114"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.114", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.73", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65010", "address-family ipv4 unicast", "neighbor 192.0.2.114 activate", "neighbor 192.0.2.114 send-community both", "exit-address-family", "clear ip bgp 192.0.2.114 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.181"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.181", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.3", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.181 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.187"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.187", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.115", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.187 next-hop-self", "clear ip bgp 192.0.2.187 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.180"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.180", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.192", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", "neighbor 192.0.2.180 activate", "exit-address-family", "clear ip bgp 192.0.2.180 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.42"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.42", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "ok"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.117", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.42 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.130"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.130", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "ok"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.118", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}], "cli_fix": ["ip route 172.16.5.0 255.255.255.0 192.0.2.254", "router bgp 65002", "clear ip bgp 192.0.2.130 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.8"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.8", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.178", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv4 unicast", "neighbor 192.0.2.8 activate", "exit-address-family", "clear ip bgp 192.0.2.8 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.118"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.118", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.167", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.118 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.85"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.85", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.178", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.85 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.129"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.129", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "ok"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.118", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.129 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.105"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.105", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.138", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "ok"}], "cli_fix": ["router bgp 65100", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.105 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.76"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.76", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.176", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "ok"}], "cli_fix": ["router bgp 65002", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.76 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.230"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.230", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.7", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv4 unicast", "neighbor 192.0.2.230 activate", "exit-address-family", "clear ip bgp 192.0.2.230 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.3"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.3", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.58", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "none"}], "cli_fix": ["router bgp 65010", "address-family ipv4 unicast", "neighbor 192.0.2.3 activate", "exit-address-family", "clear ip bgp 192.0.2.3 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.54"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.54", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.216", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.54 next-hop-self all", "clear ip bgp 192.0.2.54 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.183"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.183", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.91", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv4 unicast", "neighbor 192.0.2.183 activate", "neighbor 192.0.2.183 send-community both", "exit-address-family", "clear ip bgp 192.0.2.183 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.39"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.39", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.230", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv4 unicast", "neighbor 192.0.2.39 activate", "exit-address-family", "clear ip bgp 192.0.2.39 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.132"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.132", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.83", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.132 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.55"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.55", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.226", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.55 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.32"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.32", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.153", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}], "cli_fix": ["ip route 172.16.5.0 255.255.255.0 10.0.0.1", "router bgp 65010", "clear ip bgp 192.0.2.32 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.150"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.150", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.203", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv4 unicast", "neighbor 192.0.2.150 activate", "neighbor 192.0.2.150 send-community both", "exit-address-family", "clear ip bgp 192.0.2.150 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.174"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.174", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.185", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", "neighbor 192.0.2.174 activate", "exit-address-family", "clear ip bgp 192.0.2.174 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.176"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.176", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.161", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv4 unicast", "neighbor 192.0.2.176 activate", "neighbor 192.0.2.176 send-community both", "exit-address-family", "clear ip bgp 192.0.2.176 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.56"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.56", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.28", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65001", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.56 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.212"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.212", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.122", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.212 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.97"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.97", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "ok"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.117", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "ok"}], "cli_fix": ["router bgp 65010", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.97 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.61"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.61", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.37", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.61 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.59"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.59", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.123", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "ok"}], "cli_fix": ["router bgp 65001", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.59 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.67"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.67", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.192", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.67 activate", "neighbor 192.0.2.67 send-community both", "exit-address-family", "clear ip bgp 192.0.2.67 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.30"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.30", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.150", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65100", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.30 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.40"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.40", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.116", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "ok"}], "cli_fix": ["router bgp 65010", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.40 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.54"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.54", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.43", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65100", "address-family ipv6 unicast", "neighbor 192.0.2.54 activate", "neighbor 192.0.2.54 send-community both", "exit-address-family", "clear ip bgp 192.0.2.54 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.56"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.56", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.200", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65100", "address-family ipv6 unicast", "neighbor 192.0.2.56 activate", "neighbor 192.0.2.56 send-community both", "exit-address-family", "clear ip bgp 192.0.2.56 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.245"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.245", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.250", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", "neighbor 192.0.2.245 activate", "neighbor 192.0.2.245 send-community both", "exit-address-family", "clear ip bgp 192.0.2.245 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.122"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.122", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.129", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}], "cli_fix": ["router bgp 65001", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.122 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.119"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.119", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "ok"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.128", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.119 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.145"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.145", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.67", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.145 next-hop-self all", "clear ip bgp 192.0.2.145 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.248"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.248", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.115", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv4 unicast", "neighbor 192.0.2.248 activate", "exit-address-family", "clear ip bgp 192.0.2.248 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.29"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.29", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.14", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.29 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.52"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.52", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "ok"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.71", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.52 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.218"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.218", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.39", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", "neighbor 192.0.2.218 activate", "exit-address-family", "clear ip bgp 192.0.2.218 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.103"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.103", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.162", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", "neighbor 192.0.2.103 activate", "exit-address-family", "clear ip bgp 192.0.2.103 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.229"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.229", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.234", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.229 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.202"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.202", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.57", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.202 next-hop-self all", "clear ip bgp 192.0.2.202 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.26"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.26", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.73", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv4 unicast", "neighbor 192.0.2.26 activate", "neighbor 192.0.2.26 send-community both", "exit-address-family", "clear ip bgp 192.0.2.26 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.221"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.221", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.42", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", "neighbor 192.0.2.221 activate", "neighbor 192.0.2.221 send-community both", "exit-address-family", "clear ip bgp 192.0.2.221 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.183"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.183", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.113", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 192.0.2.254", "router bgp 65100", "clear ip bgp 192.0.2.183 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.154"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.154", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "ok"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.37", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "ok"}], "cli_fix": ["router bgp 65010", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.154 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.216"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.216", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.199", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.216 next-hop-self all", "clear ip bgp 192.0.2.216 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.43"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.43", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.49", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65100", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.43 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.150"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.150", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.29", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv6 unicast", "neighbor 192.0.2.150 activate", "neighbor 192.0.2.150 send-community both", "exit-address-family", "clear ip bgp 192.0.2.150 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.102"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.102", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.89", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv6 unicast", "neighbor 192.0.2.102 activate", "exit-address-family", "clear ip bgp 192.0.2.102 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.21"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.21", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.153", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv6 unicast", "neighbor 192.0.2.21 activate", "exit-address-family", "clear ip bgp 192.0.2.21 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.240"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.240", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.180", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "ok"}], "cli_fix": ["ip route 172.16.5.0 255.255.255.0 192.0.2.254", "router bgp 65002", "clear ip bgp 192.0.2.240 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.22"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.22", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.43", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "none"}], "cli_fix": ["router bgp 65010", "address-family ipv4 unicast", "neighbor 192.0.2.22 activate", "exit-address-family", "clear ip bgp 192.0.2.22 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.68"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.68", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.236", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.68 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.241"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.241", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.64", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.241 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.133"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.133", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.159", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65010", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.133 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.204"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.204", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "ok"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.146", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "ok"}], "cli_fix": ["ip route 172.16.5.0 255.255.255.0 192.0.2.254", "router bgp 65100", "clear ip bgp 192.0.2.204 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.24"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.24", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.117", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.24 next-hop-self all", "clear ip bgp 192.0.2.24 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.183"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.183", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.199", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv6 unicast", "neighbor 192.0.2.183 activate", "exit-address-family", "clear ip bgp 192.0.2.183 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.251"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.251", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.100", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv6 unicast", "neighbor 192.0.2.251 activate", "neighbor 192.0.2.251 send-community both", "exit-address-family", "clear ip bgp 192.0.2.251 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.138"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.138", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.57", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}], "cli_fix": ["router bgp 65002", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.138 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.155"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.155", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.37", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv4 unicast", "neighbor 192.0.2.155 activate", "exit-address-family", "clear ip bgp 192.0.2.155 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.164"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.164", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.150", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.164 next-hop-self", "clear ip bgp 192.0.2.164 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.183"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.183", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.108", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.183 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.22"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.22", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.162", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", "neighbor 192.0.2.22 activate", "exit-address-family", "clear ip bgp 192.0.2.22 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.238"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.238", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.97", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv6 unicast", "neighbor 192.0.2.238 activate", "neighbor 192.0.2.238 send-community both", "exit-address-family", "clear ip bgp 192.0.2.238 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.124"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.124", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.81", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.124 next-hop-self", "clear ip bgp 192.0.2.124 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.235"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.235", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.93", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 192.0.2.254", "router bgp 65010", "clear ip bgp 192.0.2.235 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.51"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.51", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.171", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.51 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.67"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.67", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.163", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 10.0.0.1", "router bgp 65001", "clear ip bgp 192.0.2.67 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.138"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.138", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.62", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", "neighbor 192.0.2.138 activate", "exit-address-family", "clear ip bgp 192.0.2.138 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.216"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.216", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.248", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "ok"}], "cli_fix": ["router bgp 65100", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.216 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.134"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.134", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.219", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv6 unicast", "neighbor 192.0.2.134 activate", "exit-address-family", "clear ip bgp 192.0.2.134 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.250"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.250", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.163", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "ok"}], "cli_fix": ["router bgp 65100", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.250 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.72"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.72", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.110", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv6 unicast", "neighbor 192.0.2.72 activate", "exit-address-family", "clear ip bgp 192.0.2.72 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.98"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.98", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.183", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65100", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.98 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.16"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.16", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.81", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.16 next-hop-self all", "clear ip bgp 192.0.2.16 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.137"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.137", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "ok"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.116", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}], "cli_fix": ["ip route 10.10.0.0 255.255.0.0 192.0.2.254", "router bgp 65100", "clear ip bgp 192.0.2.137 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.236"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.236", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.27", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.236 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.163"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.163", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.33", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.163 next-hop-self all", "clear ip bgp 192.0.2.163 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.79"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.79", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.36", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65010", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.79 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.127"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.127", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.196", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.127 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.142"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.142", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.174", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.142 next-hop-self all", "clear ip bgp 192.0.2.142 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.207"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.207", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.156", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.207 next-hop-self", "clear ip bgp 192.0.2.207 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.32"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.32", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.226", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "ok"}], "cli_fix": ["router bgp 65010", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.32 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.254"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.254", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.83", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.254 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.1"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.1", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.94", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", "neighbor 192.0.2.1 activate", "exit-address-family", "clear ip bgp 192.0.2.1 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.167"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.167", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.112", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "ok"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.167 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.57"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.57", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.115", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.57 next-hop-self", "clear ip bgp 192.0.2.57 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.230"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.230", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.254", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.230 next-hop-self", "clear ip bgp 192.0.2.230 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.185"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.185", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.120", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.185 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.68"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.68", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.219", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv6 unicast", "neighbor 192.0.2.68 activate", "neighbor 192.0.2.68 send-community both", "exit-address-family", "clear ip bgp 192.0.2.68 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.95"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.95", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "ok"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.22", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.95 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.213"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.213", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.66", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}], "cli_fix": ["ip route 172.16.5.0 255.255.255.0 10.0.0.1", "router bgp 65001", "clear ip bgp 192.0.2.213 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.254"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.254", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.147", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65001", "address-family ipv4 unicast", "neighbor 192.0.2.254 activate", "neighbor 192.0.2.254 send-community both", "exit-address-family", "clear ip bgp 192.0.2.254 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.70"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.70", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "ok"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.33", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "ok"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 10.0.0.1", "router bgp 65002", "clear ip bgp 192.0.2.70 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.31"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.31", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.63", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv4 unicast", "neighbor 192.0.2.31 activate", "neighbor 192.0.2.31 send-community both", "exit-address-family", "clear ip bgp 192.0.2.31 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.52"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.52", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.86", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "ok"}], "cli_fix": ["router bgp 65002", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.52 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.99"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.99", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.65", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.99 activate", "neighbor 192.0.2.99 send-community both", "exit-address-family", "clear ip bgp 192.0.2.99 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.59"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.59", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.49", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.59 next-hop-self", "clear ip bgp 192.0.2.59 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.102"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.102", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.65", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["ip route 172.16.5.0 255.255.255.0 10.0.0.1", "router bgp 65001", "clear ip bgp 192.0.2.102 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.113"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.113", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.224", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["ip route 172.16.5.0 255.255.255.0 10.0.0.1", "router bgp 65010", "clear ip bgp 192.0.2.113 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.203"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.203", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.139", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 198.51.100.2", "router bgp 65002", "clear ip bgp 192.0.2.203 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.110"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.110", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "ok"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.203", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "ok"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 10.0.0.1", "router bgp 65010", "clear ip bgp 192.0.2.110 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.180"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.180", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.8", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "ok"}], "cli_fix": ["ip route 172.16.5.0 255.255.255.0 192.0.2.254", "router bgp 65002", "clear ip bgp 192.0.2.180 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.153"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.153", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.225", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.153 next-hop-self all", "clear ip bgp 192.0.2.153 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.223"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.223", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.202", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["ip route 172.16.5.0 255.255.255.0 10.0.0.1", "router bgp 65002", "clear ip bgp 192.0.2.223 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.44"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.44", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.87", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.44 next-hop-self", "clear ip bgp 192.0.2.44 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.70"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.70", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.151", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.70 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.139"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.139", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.95", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", "neighbor 192.0.2.139 activate", "neighbor 192.0.2.139 send-community both", "exit-address-family", "clear ip bgp 192.0.2.139 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.242"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.242", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "ok"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.184", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65002", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.242 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.86"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.86", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.216", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "ok"}], "cli_fix": ["ip route 172.16.5.0 255.255.255.0 10.0.0.1", "router bgp 65001", "clear ip bgp 192.0.2.86 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.67"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.67", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.34", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65010", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.67 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.29"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.29", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "ok"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.26", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "ok"}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.29 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.252"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.252", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.93", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65100", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.252 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.108"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.108", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.4", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.108 activate", "exit-address-family", "clear ip bgp 192.0.2.108 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.154"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.154", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.160", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 192.0.2.254", "router bgp 65002", "clear ip bgp 192.0.2.154 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.26"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.26", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.219", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "ok"}], "cli_fix": ["ip route 10.10.0.0 255.255.0.0 192.0.2.254", "router bgp 65002", "clear ip bgp 192.0.2.26 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.143"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.143", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.212", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.143 next-hop-self all", "clear ip bgp 192.0.2.143 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.80"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.80", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.108", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.80 activate", "exit-address-family", "clear ip bgp 192.0.2.80 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.194"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.194", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.91", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "none"}], "cli_fix": ["router bgp 65100", "address-family ipv4 unicast", "neighbor 192.0.2.194 activate", "neighbor 192.0.2.194 send-community both", "exit-address-family", "clear ip bgp 192.0.2.194 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.175"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.175", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.16", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.175 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.200"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.200", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.215", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.200 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.53"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.53", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.197", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "ok"}], "cli_fix": ["ip route 172.16.5.0 255.255.255.0 198.51.100.2", "router bgp 65010", "clear ip bgp 192.0.2.53 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.123"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.123", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.173", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv6 unicast", "neighbor 192.0.2.123 activate", "exit-address-family", "clear ip bgp 192.0.2.123 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.231"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.231", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.42", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv4 unicast", "neighbor 192.0.2.231 activate", "neighbor 192.0.2.231 send-community both", "exit-address-family", "clear ip bgp 192.0.2.231 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.144"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.144", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.155", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.144 next-hop-self all", "clear ip bgp 192.0.2.144 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.112"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.112", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.91", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.112 next-hop-self all", "clear ip bgp 192.0.2.112 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.76"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.76", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.241", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.76 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.96"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.96", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.189", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.96 next-hop-self", "clear ip bgp 192.0.2.96 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.6"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.6", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.238", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv6 unicast", "neighbor 192.0.2.6 activate", "exit-address-family", "clear ip bgp 192.0.2.6 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.58"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.58", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.254", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv6 unicast", "neighbor 192.0.2.58 activate", "exit-address-family", "clear ip bgp 192.0.2.58 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.18"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.18", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.183", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.18 next-hop-self", "clear ip bgp 192.0.2.18 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.118"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.118", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.207", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv4 unicast", "neighbor 192.0.2.118 activate", "exit-address-family", "clear ip bgp 192.0.2.118 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.37"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.37", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.76", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv6 unicast", "neighbor 192.0.2.37 activate", "exit-address-family", "clear ip bgp 192.0.2.37 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.110"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.110", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.227", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}], "cli_fix": ["ip route 10.10.0.0 255.255.0.0 198.51.100.2", "router bgp 65002", "clear ip bgp 192.0.2.110 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.93"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.93", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.178", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.93 next-hop-self", "clear ip bgp 192.0.2.93 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.179"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.179", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.174", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65001", "address-family ipv4 unicast", "neighbor 192.0.2.179 activate", "exit-address-family", "clear ip bgp 192.0.2.179 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.232"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.232", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.74", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.232 next-hop-self all", "clear ip bgp 192.0.2.232 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.172"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.172", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.189", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.172 next-hop-self", "clear ip bgp 192.0.2.172 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.122"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.122", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.14", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv6 unicast", "neighbor 192.0.2.122 activate", "exit-address-family", "clear ip bgp 192.0.2.122 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.67"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.67", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.78", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}], "cli_fix": ["ip route 172.16.5.0 255.255.255.0 198.51.100.2", "router bgp 65010", "clear ip bgp 192.0.2.67 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.205"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.205", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.26", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv4 unicast", "neighbor 192.0.2.205 activate", "neighbor 192.0.2.205 send-community both", "exit-address-family", "clear ip bgp 192.0.2.205 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.62"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.62", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "ok"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.45", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}], "cli_fix": ["ip route 10.10.0.0 255.255.0.0 192.0.2.254", "router bgp 65002", "clear ip bgp 192.0.2.62 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.76"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.76", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.50", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.76 next-hop-self", "clear ip bgp 192.0.2.76 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.150"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.150", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "ok"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.151", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65010", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.150 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.21"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.21", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.177", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "none"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", "neighbor 192.0.2.21 activate", "exit-address-family", "clear ip bgp 192.0.2.21 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.59"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.59", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.224", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.59 next-hop-self", "clear ip bgp 192.0.2.59 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.32"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.32", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "ok"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.50", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["ip route 10.10.0.0 255.255.0.0 198.51.100.2", "router bgp 65100", "clear ip bgp 192.0.2.32 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.219"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.219", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.16", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.219 next-hop-self all", "clear ip bgp 192.0.2.219 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.202"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.202", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.170", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", "neighbor 192.0.2.202 activate", "neighbor 192.0.2.202 send-community both", "exit-address-family", "clear ip bgp 192.0.2.202 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.123"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.123", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.20", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "none"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.123 activate", "neighbor 192.0.2.123 send-community both", "exit-address-family", "clear ip bgp 192.0.2.123 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.160"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.160", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.59", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.160 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.45"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.45", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.84", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "ok"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.45 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.217"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.217", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.154", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.217 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.8"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.8", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "ok"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.236", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["ip route 10.10.0.0 255.255.0.0 192.0.2.254", "router bgp 65100", "clear ip bgp 192.0.2.8 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.55"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.55", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.114", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.55 next-hop-self all", "clear ip bgp 192.0.2.55 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.216"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.216", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.134", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 10.0.0.1", "router bgp 65010", "clear ip bgp 192.0.2.216 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.176"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.176", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.202", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.176 next-hop-self all", "clear ip bgp 192.0.2.176 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.130"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.130", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "ok"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.218", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["router bgp 65010", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.130 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.190"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.190", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.16", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", "neighbor 192.0.2.190 activate", "neighbor 192.0.2.190 send-community both", "exit-address-family", "clear ip bgp 192.0.2.190 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.163"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.163", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "ok"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.39", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "ok"}], "cli_fix": ["router bgp 65002", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.163 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.87"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.87", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.121", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.87 next-hop-self", "clear ip bgp 192.0.2.87 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.30"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.30", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.23", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65002", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.30 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.83"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.83", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.122", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["router bgp 65001", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.83 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.47"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.47", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.152", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.47 next-hop-self all", "clear ip bgp 192.0.2.47 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.132"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.132", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "ok"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.224", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.132 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.184"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.184", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.5", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.184 next-hop-self", "clear ip bgp 192.0.2.184 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.82"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.82", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "ok"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.246", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65100", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.82 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.166"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.166", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.196", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.166 activate", "neighbor 192.0.2.166 send-community both", "exit-address-family", "clear ip bgp 192.0.2.166 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.58"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.58", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.146", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.58 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.133"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.133", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.92", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}], "cli_fix": ["ip route 172.16.5.0 255.255.255.0 192.0.2.254", "router bgp 65100", "clear ip bgp 192.0.2.133 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.47"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.47", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.103", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.47 activate", "neighbor 192.0.2.47 send-community both", "exit-address-family", "clear ip bgp 192.0.2.47 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.233"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.233", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.82", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.233 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.18"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.18", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.153", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.18 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.13"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.13", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.53", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "ok"}], "cli_fix": ["ip route 10.10.0.0 255.255.0.0 192.0.2.254", "router bgp 65010", "clear ip bgp 192.0.2.13 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.61"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.61", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.149", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.61 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.60"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.60", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "ok"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.89", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 198.51.100.2", "router bgp 65002", "clear ip bgp 192.0.2.60 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.98"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.98", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.253", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "none"}], "cli_fix": ["router bgp 65001", "address-family ipv4 unicast", "neighbor 192.0.2.98 activate", "exit-address-family", "clear ip bgp 192.0.2.98 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.184"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.184", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.228", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", "neighbor 192.0.2.184 activate", "exit-address-family", "clear ip bgp 192.0.2.184 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.6"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.6", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.154", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "ok"}], "cli_fix": ["ip route 10.10.0.0 255.255.0.0 10.0.0.1", "router bgp 65002", "clear ip bgp 192.0.2.6 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.137"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.137", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.171", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.137 next-hop-self", "clear ip bgp 192.0.2.137 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.24"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.24", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.54", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "none"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", "neighbor 192.0.2.24 activate", "exit-address-family", "clear ip bgp 192.0.2.24 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.220"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.220", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.233", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.220 next-hop-self", "clear ip bgp 192.0.2.220 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.131"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.131", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.253", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.131 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.42"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.42", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "ok"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.4", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["ip route 10.10.0.0 255.255.0.0 10.0.0.1", "router bgp 65001", "clear ip bgp 192.0.2.42 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.31"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.31", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.138", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.31 next-hop-self", "clear ip bgp 192.0.2.31 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.155"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.155", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.233", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.155 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.30"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.30", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.20", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.30 activate", "neighbor 192.0.2.30 send-community both", "exit-address-family", "clear ip bgp 192.0.2.30 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.158"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.158", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.187", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.158 next-hop-self all", "clear ip bgp 192.0.2.158 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.118"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.118", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.194", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", "neighbor 192.0.2.118 activate", "exit-address-family", "clear ip bgp 192.0.2.118 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.190"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.190", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.220", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.190 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.58"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.58", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "ok"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.247", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}], "cli_fix": ["router bgp 65002", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.58 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.172"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.172", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.97", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.172 next-hop-self all", "clear ip bgp 192.0.2.172 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.10"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.10", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.202", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.10 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.111"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.111", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.82", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["ip route 172.16.5.0 255.255.255.0 198.51.100.2", "router bgp 65010", "clear ip bgp 192.0.2.111 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.157"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.157", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.221", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.157 next-hop-self", "clear ip bgp 192.0.2.157 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.128"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.128", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.210", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.128 next-hop-self", "clear ip bgp 192.0.2.128 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.20"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.20", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.134", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["ip route 172.16.5.0 255.255.255.0 10.0.0.1", "router bgp 65010", "clear ip bgp 192.0.2.20 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.77"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.77", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.213", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.77 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.105"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.105", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.24", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", "neighbor 192.0.2.105 activate", "exit-address-family", "clear ip bgp 192.0.2.105 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.130"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.130", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.101", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", "neighbor 192.0.2.130 activate", "exit-address-family", "clear ip bgp 192.0.2.130 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.48"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.48", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.231", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.48 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.79"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.79", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.229", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.79 next-hop-self", "clear ip bgp 192.0.2.79 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.25"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.25", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.167", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.25 next-hop-self", "clear ip bgp 192.0.2.25 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.216"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.216", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.189", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.216 next-hop-self all", "clear ip bgp 192.0.2.216 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.101"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.101", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.136", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv4 unicast", "neighbor 192.0.2.101 activate", "neighbor 192.0.2.101 send-community both", "exit-address-family", "clear ip bgp 192.0.2.101 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.218"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.218", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.214", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv4 unicast", "neighbor 192.0.2.218 activate", "exit-address-family", "clear ip bgp 192.0.2.218 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.22"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.22", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.4", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv6 unicast", "neighbor 192.0.2.22 activate", "neighbor 192.0.2.22 send-community both", "exit-address-family", "clear ip bgp 192.0.2.22 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.197"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.197", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.60", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.197 next-hop-self all", "clear ip bgp 192.0.2.197 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.42"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.42", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.131", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.42 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.129"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.129", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.116", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv6 unicast", "neighbor 192.0.2.129 activate", "neighbor 192.0.2.129 send-community both", "exit-address-family", "clear ip bgp 192.0.2.129 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.86"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.86", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.17", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv4 unicast", "neighbor 192.0.2.86 activate", "exit-address-family", "clear ip bgp 192.0.2.86 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.57"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.57", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.14", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.57 next-hop-self", "clear ip bgp 192.0.2.57 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.41"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.41", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.215", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.41 next-hop-self", "clear ip bgp 192.0.2.41 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.146"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.146", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.45", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["ip route 10.10.0.0 255.255.0.0 10.0.0.1", "router bgp 65010", "clear ip bgp 192.0.2.146 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.214"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.214", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.123", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.214 next-hop-self all", "clear ip bgp 192.0.2.214 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.8"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.8", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.48", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv6 unicast", "neighbor 192.0.2.8 activate", "exit-address-family", "clear ip bgp 192.0.2.8 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.104"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.104", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.225", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.104 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.122"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.122", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.216", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.122 next-hop-self all", "clear ip bgp 192.0.2.122 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.62"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.62", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.175", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65001", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.62 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.136"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.136", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "ok"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.210", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "ok"}], "cli_fix": ["ip route 172.16.5.0 255.255.255.0 10.0.0.1", "router bgp 65002", "clear ip bgp 192.0.2.136 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.123"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.123", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.74", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv6 unicast", "neighbor 192.0.2.123 activate", "neighbor 192.0.2.123 send-community both", "exit-address-family", "clear ip bgp 192.0.2.123 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.130"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.130", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.106", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.130 next-hop-self", "clear ip bgp 192.0.2.130 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.184"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.184", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.220", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["ip route 10.10.0.0 255.255.0.0 192.0.2.254", "router bgp 65001", "clear ip bgp 192.0.2.184 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.113"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.113", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.249", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.113 next-hop-self all", "clear ip bgp 192.0.2.113 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.167"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.167", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.202", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.167 next-hop-self all", "clear ip bgp 192.0.2.167 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.105"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.105", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.61", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65001", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.105 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.140"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.140", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.71", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.140 next-hop-self", "clear ip bgp 192.0.2.140 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.6"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.6", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.26", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65001", "address-family ipv4 unicast", "neighbor 192.0.2.6 activate", "exit-address-family", "clear ip bgp 192.0.2.6 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.169"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.169", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.115", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv6 unicast", "neighbor 192.0.2.169 activate", "neighbor 192.0.2.169 send-community both", "exit-address-family", "clear ip bgp 192.0.2.169 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.40"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.40", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "ok"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.179", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "ok"}], "cli_fix": ["ip route 10.10.0.0 255.255.0.0 198.51.100.2", "router bgp 65010", "clear ip bgp 192.0.2.40 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.3"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.3", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.44", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.3 next-hop-self", "clear ip bgp 192.0.2.3 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.148"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.148", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.124", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65001", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.148 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.129"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.129", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.145", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", "neighbor 192.0.2.129 activate", "neighbor 192.0.2.129 send-community both", "exit-address-family", "clear ip bgp 192.0.2.129 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.47"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.47", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.14", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "none"}], "cli_fix": ["router bgp 65001", "address-family ipv4 unicast", "neighbor 192.0.2.47 activate", "neighbor 192.0.2.47 send-community both", "exit-address-family", "clear ip bgp 192.0.2.47 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.205"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.205", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.100", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "ok"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.205 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.233"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.233", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.126", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 198.51.100.2", "router bgp 65002", "clear ip bgp 192.0.2.233 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.105"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.105", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.55", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65100", "address-family ipv4 unicast", "neighbor 192.0.2.105 activate", "neighbor 192.0.2.105 send-community both", "exit-address-family", "clear ip bgp 192.0.2.105 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.202"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.202", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.190", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "ok"}], "cli_fix": ["ip route 172.16.5.0 255.255.255.0 10.0.0.1", "router bgp 65002", "clear ip bgp 192.0.2.202 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.15"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.15", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.226", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65010", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.15 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.121"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.121", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.106", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.121 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.80"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.80", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.252", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.80 next-hop-self", "clear ip bgp 192.0.2.80 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.227"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.227", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.27", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.227 next-hop-self all", "clear ip bgp 192.0.2.227 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.113"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.113", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.23", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv4 unicast", "neighbor 192.0.2.113 activate", "exit-address-family", "clear ip bgp 192.0.2.113 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.254"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.254", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.124", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.254 next-hop-self all", "clear ip bgp 192.0.2.254 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.51"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.51", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.144", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.51 next-hop-self all", "clear ip bgp 192.0.2.51 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.62"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.62", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.17", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.62 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.237"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.237", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.118", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.237 next-hop-self all", "clear ip bgp 192.0.2.237 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.143"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.143", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.130", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65100", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.143 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.50"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.50", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "ok"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.125", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["router bgp 65100", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.50 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.171"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.171", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.210", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv6 unicast", "neighbor 192.0.2.171 activate", "neighbor 192.0.2.171 send-community both", "exit-address-family", "clear ip bgp 192.0.2.171 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.205"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.205", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "ok"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.37", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}], "cli_fix": ["ip route 172.16.5.0 255.255.255.0 192.0.2.254", "router bgp 65002", "clear ip bgp 192.0.2.205 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.210"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.210", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.65", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}], "cli_fix": ["router bgp 65002", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.210 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.224"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.224", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.249", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.224 next-hop-self", "clear ip bgp 192.0.2.224 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.36"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.36", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.93", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.36 next-hop-self", "clear ip bgp 192.0.2.36 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.18"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.18", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.124", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.18 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.161"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.161", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.113", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv6 unicast", "neighbor 192.0.2.161 activate", "exit-address-family", "clear ip bgp 192.0.2.161 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.113"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.113", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.140", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.113 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.230"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.230", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.41", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv4 unicast", "neighbor 192.0.2.230 activate", "exit-address-family", "clear ip bgp 192.0.2.230 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.69"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.69", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.68", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", "neighbor 192.0.2.69 activate", "exit-address-family", "clear ip bgp 192.0.2.69 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.242"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.242", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.203", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65100", "address-family ipv6 unicast", "neighbor 192.0.2.242 activate", "neighbor 192.0.2.242 send-community both", "exit-address-family", "clear ip bgp 192.0.2.242 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.173"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.173", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.159", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv4 unicast", "neighbor 192.0.2.173 activate", "neighbor 192.0.2.173 send-community both", "exit-address-family", "clear ip bgp 192.0.2.173 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.44"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.44", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.101", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65002", "address-family ipv6 unicast", "neighbor 192.0.2.44 activate", "neighbor 192.0.2.44 send-community both", "exit-address-family", "clear ip bgp 192.0.2.44 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.248"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.248", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.112", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv4 unicast", "neighbor 192.0.2.248 activate", "exit-address-family", "clear ip bgp 192.0.2.248 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.15"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.15", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.129", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv6 unicast", "neighbor 192.0.2.15 activate", "exit-address-family", "clear ip bgp 192.0.2.15 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.112"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.112", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.106", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "ok"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.112 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.42"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.42", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.61", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65100", "address-family ipv6 unicast", "neighbor 192.0.2.42 activate", "exit-address-family", "clear ip bgp 192.0.2.42 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.203"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.203", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.77", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65100", "address-family ipv6 unicast", "neighbor 192.0.2.203 activate", "neighbor 192.0.2.203 send-community both", "exit-address-family", "clear ip bgp 192.0.2.203 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.214"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.214", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.112", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv6 unicast", "neighbor 192.0.2.214 activate", "neighbor 192.0.2.214 send-community both", "exit-address-family", "clear ip bgp 192.0.2.214 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.254"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.254", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.80", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.254 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.29"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.29", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.38", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "none"}], "cli_fix": ["router bgp 65010", "address-family ipv4 unicast", "neighbor 192.0.2.29 activate", "neighbor 192.0.2.29 send-community both", "exit-address-family", "clear ip bgp 192.0.2.29 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.156"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.156", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.108", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "ok"}], "cli_fix": ["router bgp 65002", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.156 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.155"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.155", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.12", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.155 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.99"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.99", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.177", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.99 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.20"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.20", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.60", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.20 next-hop-self all", "clear ip bgp 192.0.2.20 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.70"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.70", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.233", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.70 next-hop-self", "clear ip bgp 192.0.2.70 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.205"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.205", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "inconsistent"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.242", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65010", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.205 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.127"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.127", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.48", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv6 unicast", "neighbor 192.0.2.127 activate", "neighbor 192.0.2.127 send-community both", "exit-address-family", "clear ip bgp 192.0.2.127 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.23"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.23", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.250", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv6 unicast", "neighbor 192.0.2.23 activate", "neighbor 192.0.2.23 send-community both", "exit-address-family", "clear ip bgp 192.0.2.23 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.97"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.97", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.43", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "ok"}], "cli_fix": ["router bgp 65100", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.97 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.93"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.93", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.4", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.93 next-hop-self", "clear ip bgp 192.0.2.93 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.78"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.78", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.242", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv4 unicast", "neighbor 192.0.2.78 activate", "neighbor 192.0.2.78 send-community both", "exit-address-family", "clear ip bgp 192.0.2.78 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.250"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.250", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.159", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.250 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.228"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.228", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.233", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "admin_distance", "cef_state": "ok"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.228 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.154"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.154", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.164", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv4 unicast", "neighbor 192.0.2.154 activate", "exit-address-family", "clear ip bgp 192.0.2.154 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.41"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.41", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "ok"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.205", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65100", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.41 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.38"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.38", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.165", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "client"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.38 next-hop-self", "clear ip bgp 192.0.2.38 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.187"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.187", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.18", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.187 next-hop-self", "clear ip bgp 192.0.2.187 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.19"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.19", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.92", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", "neighbor 192.0.2.19 activate", "exit-address-family", "clear ip bgp 192.0.2.19 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.98"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.98", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.120", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.98 next-hop-self", "clear ip bgp 192.0.2.98 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.139"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.139", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.64", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}], "cli_fix": ["ip route 10.10.0.0 255.255.0.0 198.51.100.2", "router bgp 65001", "clear ip bgp 192.0.2.139 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.209"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.209", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "none"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.73", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.209 next-hop-self", "clear ip bgp 192.0.2.209 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.119"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.119", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.131", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv4 unicast", "neighbor 192.0.2.119 activate", "exit-address-family", "clear ip bgp 192.0.2.119 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.145"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.145", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.71", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.145 activate", "neighbor 192.0.2.145 send-community both", "exit-address-family", "clear ip bgp 192.0.2.145 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.7"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.7", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.237", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", "neighbor 192.0.2.7 activate", "exit-address-family", "clear ip bgp 192.0.2.7 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.105"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.105", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.4", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "ok"}], "cli_fix": ["ip route 10.10.0.0 255.255.0.0 10.0.0.1", "router bgp 65010", "clear ip bgp 192.0.2.105 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.141"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.141", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "client"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.240", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.141 next-hop-self all", "clear ip bgp 192.0.2.141 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.105"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.105", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.4", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv6 unicast", "neighbor 192.0.2.105 activate", "exit-address-family", "clear ip bgp 192.0.2.105 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.51"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.51", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.194", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.51 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.21"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.21", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.146", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "none"}], "cli_fix": ["router bgp 65010", "clear ip bgp 192.0.2.21 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.192"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.192", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.13", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "ok"}], "cli_fix": ["router bgp 65002", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.192 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.245"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.245", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.146", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65100", "address-family ipv6 unicast", "neighbor 192.0.2.245 activate", "exit-address-family", "clear ip bgp 192.0.2.245 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.105"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.105", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "next_hop_unreachable", "cef_state": "ok"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.210", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "ok"}], "cli_fix": ["router bgp 65001", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.105 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.74"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.74", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.125", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": false, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65001", "clear ip bgp 192.0.2.74 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.6"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.6", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.131", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.6 next-hop-self all", "clear ip bgp 192.0.2.6 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.95"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.95", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.168", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv4 unicast", "neighbor 192.0.2.95 activate", "neighbor 192.0.2.95 send-community both", "exit-address-family", "clear ip bgp 192.0.2.95 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.195"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.195", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "inconsistent"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.100", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["ip route 10.10.0.0 255.255.0.0 198.51.100.2", "router bgp 65002", "clear ip bgp 192.0.2.195 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.207"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.207", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.246", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv4 unicast", "neighbor 192.0.2.207 activate", "neighbor 192.0.2.207 send-community both", "exit-address-family", "clear ip bgp 192.0.2.207 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.206"}, "devices": [{"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.206", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.111", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.206 activate", "exit-address-family", "clear ip bgp 192.0.2.206 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.22"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.22", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.105", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65001", "neighbor 192.0.2.22 next-hop-self all", "clear ip bgp 192.0.2.22 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.7"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.7", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.9", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 192.0.2.254", "router bgp 65001", "clear ip bgp 192.0.2.7 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.219"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.219", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.85", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "none"}], "cli_fix": ["router bgp 65100", "address-family ipv6 unicast", "neighbor 192.0.2.219 activate", "neighbor 192.0.2.219 send-community both", "exit-address-family", "clear ip bgp 192.0.2.219 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.51"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.51", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.16", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "none"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.51 activate", "exit-address-family", "clear ip bgp 192.0.2.51 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.62"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.62", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.155", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "ok"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.62 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "critical", "neighbor": "192.0.2.177"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.177", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "route_reflector"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.103", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.177 next-hop-self all", "clear ip bgp 192.0.2.177 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.254"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.254", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.190", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.254 next-hop-self", "clear ip bgp 192.0.2.254 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.174"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.174", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.7", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "none"}], "cli_fix": ["router bgp 65010", "address-family ipv4 unicast", "neighbor 192.0.2.174 activate", "neighbor 192.0.2.174 send-community both", "exit-address-family", "clear ip bgp 192.0.2.174 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.228"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.228", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.58", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv4 unicast", "neighbor 192.0.2.228 activate", "neighbor 192.0.2.228 send-community both", "exit-address-family", "clear ip bgp 192.0.2.228 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "medium", "neighbor": "192.0.2.153"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.153", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "EDGE-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.41", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "route_reflector"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.153 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.207"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.207", "remote_as": 65100, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.244", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "rpf_fail", "cef_state": "ok"}], "cli_fix": ["router bgp 65002", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.207 soft in"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.123"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.123", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.215", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.123 next-hop-self all", "clear ip bgp 192.0.2.123 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "critical", "neighbor": "192.0.2.168"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.168", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv6", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.240", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "none"}], "cli_fix": ["router bgp 65100", "address-family ipv4 unicast", "neighbor 192.0.2.168 activate", "exit-address-family", "clear ip bgp 192.0.2.168 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.184"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.184", "remote_as": 65001, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "eBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": false, "rr_topology": "route_reflector"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.107", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65002", "clear ip bgp 192.0.2.184 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.60"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.60", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.183", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "ok"}], "cli_fix": ["router bgp 65100", "clear ip bgp 192.0.2.60 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.8"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.8", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.171", "remote_as": 65100, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv6 unicast", "neighbor 192.0.2.8 activate", "exit-address-family", "clear ip bgp 192.0.2.8 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "DC-RTR1", "severity": "high", "neighbor": "192.0.2.184"}, "devices": [{"name": "DC-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.184", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.77", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65001", "address-family ipv6 unicast", "neighbor 192.0.2.184 activate", "neighbor 192.0.2.184 send-community both", "exit-address-family", "clear ip bgp 192.0.2.184 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.63"}, "devices": [{"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.63", "remote_as": 65010, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "none"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.104", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.63 next-hop-self", "clear ip bgp 192.0.2.63 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "high", "neighbor": "192.0.2.91"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.91", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "ipv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.232", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "none"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.91 activate", "exit-address-family", "clear ip bgp 192.0.2.91 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.78"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.78", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "10.255.255.1", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.208", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "eBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65002", "neighbor 192.0.2.78 next-hop-self", "clear ip bgp 192.0.2.78 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.231"}, "devices": [{"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.231", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "ok"}, {"name": "EDGE-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.160", "remote_as": 65001, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 10.0.0.1", "router bgp 65001", "clear ip bgp 192.0.2.231 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "EDGE-RTR1", "severity": "medium", "neighbor": "192.0.2.55"}, "devices": [{"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.55", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}, {"name": "BRANCH-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.127", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "unicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65002", "address-family ipv4 unicast", "neighbor 192.0.2.55 activate", "exit-address-family", "clear ip bgp 192.0.2.55 soft out"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "critical", "neighbor": "192.0.2.29"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.29", "remote_as": 65002, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": true, "caps_advertised": "none"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.120", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "ipv6", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv4-unicast only"}], "cli_fix": ["router bgp 65100", "address-family ipv4 unicast", "neighbor 192.0.2.29 activate", "neighbor 192.0.2.29 send-community both", "exit-address-family", "clear ip bgp 192.0.2.29 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.40"}, "devices": [{"name": "DC-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.40", "remote_as": 65001, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "BRANCH-RTR1", "local_as": 65001, "neighbor_ip": "192.0.2.195", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 60, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": false, "rr_topology": "client"}], "cli_fix": ["router bgp 65010", "neighbor 192.0.2.40 next-hop-self all", "clear ip bgp 192.0.2.40 soft out"]}
{"incident_type": "bgp_next_hop_self_issue", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP next-hop self issue", "device": "DC-RTR1", "severity": "critical", "neighbor": "192.0.2.195"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.195", "remote_as": 65001, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "route_type": "iBGP", "next_hop_seen": "0.0.0.0", "next_hop_reachable": true, "rr_topology": "client"}, {"name": "CORE-R1", "local_as": 65001, "neighbor_ip": "192.0.2.127", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "route_type": "iBGP", "next_hop_seen": "192.0.2.254", "next_hop_reachable": true, "rr_topology": "none"}], "cli_fix": ["router bgp 65100", "neighbor 192.0.2.195 next-hop-self", "clear ip bgp 192.0.2.195 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.118"}, "devices": [{"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.118", "remote_as": 65010, "interface": "GigabitEthernet0/2", "peer_keepalive": 60, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}, {"name": "BRANCH-RTR1", "local_as": 65010, "neighbor_ip": "192.0.2.75", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "10.10.0.0/16", "rib_install": "not_installed", "reason": "rpf_fail", "cef_state": "inconsistent"}], "cli_fix": ["router bgp 65100", "bgp bestpath compare-routerid", "clear ip bgp 192.0.2.118 soft in"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "BRANCH-RTR1", "severity": "high", "neighbor": "192.0.2.176"}, "devices": [{"name": "BRANCH-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.176", "remote_as": 65100, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "not_installed", "reason": "admin_distance", "cef_state": "inconsistent"}, {"name": "CORE-R1", "local_as": 65100, "neighbor_ip": "192.0.2.76", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 180, "bgp_prefix_in_table": "172.16.5.0/24", "rib_install": "installed_partial", "reason": "next_hop_unreachable", "cef_state": "inconsistent"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 10.0.0.1", "router bgp 65002", "clear ip bgp 192.0.2.176 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "medium", "neighbor": "192.0.2.61"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.61", "remote_as": 65002, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv6", "safi": "evpn", "neighbor_activated": true, "caps_advertised": "ipv4-unicast only"}, {"name": "EDGE-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.110", "remote_as": 65010, "interface": "Loopback0", "peer_keepalive": 60, "peer_hold": 180, "afi": "vpnv4", "safi": "multicast", "neighbor_activated": false, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv4 unicast", "neighbor 192.0.2.61 activate", "exit-address-family", "clear ip bgp 192.0.2.61 soft out"]}
{"incident_type": "bgp_missing_routes_in_rib", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP routes missing in RIB", "device": "DC-RTR1", "severity": "medium", "neighbor": "192.0.2.193"}, "devices": [{"name": "DC-RTR1", "local_as": 65100, "neighbor_ip": "192.0.2.193", "remote_as": 65002, "interface": "GigabitEthernet0/0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "not_installed", "reason": "route_map_denied", "cef_state": "ok"}, {"name": "CORE-R1", "local_as": 65002, "neighbor_ip": "192.0.2.212", "remote_as": 65100, "interface": "Loopback0", "peer_keepalive": 30, "peer_hold": 90, "bgp_prefix_in_table": "203.0.113.0/24", "rib_install": "installed_partial", "reason": "route_map_denied", "cef_state": "inconsistent"}], "cli_fix": ["ip route 203.0.113.0 255.255.255.0 10.0.0.1", "router bgp 65100", "clear ip bgp 192.0.2.193 soft in"]}
{"incident_type": "bgp_afi_safi_mismatch", "instruction": "Analyze BGP forwarding/AFI issues and output ONLY CLI FIX COMMANDS. Do not provide explanation.", "rules": ["Prefer minimal-impact actions", "Use soft reset when changing policy or AFI/SAFI activation", "Do not change BGP timers unless the incident is session stability related", "Do NOT provide explanation"], "wazuh_alert": {"rule": "BGP AFI/SAFI mismatch", "device": "CORE-R1", "severity": "high", "neighbor": "192.0.2.139"}, "devices": [{"name": "CORE-R1", "local_as": 65010, "neighbor_ip": "192.0.2.139", "remote_as": 65002, "interface": "GigabitEthernet0/2", "peer_keepalive": 30, "peer_hold": 90, "afi": "vpnv4", "safi": "evpn", "neighbor_activated": false, "caps_advertised": "none"}, {"name": "DC-RTR1", "local_as": 65002, "neighbor_ip": "192.0.2.201", "remote_as": 65010, "interface": "GigabitEthernet0/1", "peer_keepalive": 30, "peer_hold": 180, "afi": "ipv4", "safi": "unicast", "neighbor_activated": true, "caps_advertised": "ipv6-unicast only"}], "cli_fix": ["router bgp 65010", "address-family ipv6 unicast", "neighbor 192.0.2.139 activate", "neighbor 192.0.2.139 send-community both", "exit-address-family", "clear ip bgp 192.0.2.139 soft out"]}