{"instruction": "Mitigate SSH brute force from 185.199.108.1 and restrict VTY access to trusted networks", "config_raw": "ip ssh version 2\nline vty 0 4\n transport input ssh\n login local\n!\n", "wazuh_alert": {"type": "ssh_bruteforce", "src_ip": "185.199.108.1", "dst_ip": "192.168.0.1", "severity": "critical", "attempts": 130}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list standard SSH_ADMIN", " deny 185.199.108.1", " permit 192.168.0.0 0.0.255.255", "line vty 0 4", " access-class SSH_ADMIN in"], "verify": ["show access-lists SSH_ADMIN", "show line vty 0"], "rollback": ["no ip access-list standard SSH_ADMIN"], "explain": "Blocks attacker IP from accessing VTY and limits SSH access to known management networks. Verify that legitimate admins are within allowed range."}]}
{"instruction": "Mitigate SSH brute force from 45.33.32.1 and restrict VTY access to trusted networks", "config_raw": "ip ssh version 2\nline vty 0 4\n transport input ssh\n login local\n!\n", "wazuh_alert": {"type": "ssh_bruteforce", "src_ip": "45.33.32.1", "dst_ip": "172.16.0.1", "severity": "critical", "attempts": 167}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list standard SSH_ADMIN", " deny 45.33.32.1", " permit 192.168.0.0 0.0.255.255", "line vty 0 4", " access-class SSH_ADMIN in"], "verify": ["show access-lists SSH_ADMIN", "show line vty 0"], "rollback": ["no ip access-list standard SSH_ADMIN"], "explain": "Blocks attacker IP from accessing VTY and limits SSH access to known management networks. Verify that legitimate admins are within allowed range."}]}
{"instruction": "Prevent ARP spoofing on interface GigabitEthernet0/2", "config_raw": "interface GigabitEthernet0/2\n ip address 10.0.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "arp_spoofing", "src_ip": "10.0.0.1", "severity": "medium"}, "gold_actions": [{"action_type": "hardening", "commands": ["interface GigabitEthernet0/2", " ip arp inspection trust", " ip dhcp snooping trust"], "verify": ["show ip arp inspection interfaces"], "rollback": ["interface GigabitEthernet0/2", " no ip arp inspection trust"], "explain": "Enable DAI and DHCP snooping to reduce ARP spoofing risk. Requires global DHCP snooping/DAI config."}]}
{"instruction": "Contain suspected data exfiltration from inside host 192.168.0.1 to external 185.199.108.1", "config_raw": "interface GigabitEthernet0/2\n ip address 192.168.0.1 255.255.255.0\n ip nat inside\n!\ninterface GigabitEthernet0/3\n ip address 45.33.32.1 255.255.255.0\n ip nat outside\n!\nip nat inside source static 192.168.0.1 185.199.108.1\n", "wazuh_alert": {"type": "data_exfiltration", "src_ip": "192.168.0.1", "dst_ip": "185.199.108.1", "severity": "critical", "evidence": ["large_transfer", "unusual_protocol"]}, "gold_actions": [{"action_type": "containment", "commands": ["ip access-list extended EXFIL_BLOCK", " deny ip host 192.168.0.1 any", " permit ip any any", "interface GigabitEthernet0/2", " ip access-group EXFIL_BLOCK in"], "verify": ["show access-lists EXFIL_BLOCK"], "rollback": ["no ip access-list extended EXFIL_BLOCK"], "explain": "Blocks outbound traffic temporarily from the compromised internal host to prevent further data exfiltration. Host may lose network access."}]}
{"instruction": "Mitigate ICMP/UDP flood from 198.51.100.1 towards interface GigabitEthernet0/1", "config_raw": "interface GigabitEthernet0/1\n ip address 192.168.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "icmp_flood", "src_ip": "198.51.100.1", "severity": "high", "pps": 74686}, "gold_actions": [{"action_type": "mitigation", "commands": ["control-plane", " service-policy input LIMIT_ICMP", "policy-map LIMIT_ICMP", " class class-default", "  police 8000 conform-action transmit exceed-action drop"], "verify": ["show policy-map interface control-plane"], "rollback": ["no policy-map LIMIT_ICMP"], "explain": "Rate-limits ICMP on the control plane to protect device CPU from flood. Verify in lab prior to production."}]}
{"instruction": "Block traffic from 203.0.113.1 at ingress on interface GigabitEthernet0/0", "config_raw": "interface GigabitEthernet0/0\n ip address 10.0.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "203.0.113.1", "dst_ip": "192.168.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_203_0_113_1", " deny ip host 203.0.113.1 any", " permit ip any any", "interface GigabitEthernet0/0", " ip access-group TEMP_BLOCK_203_0_113_1 in"], "verify": ["show access-lists TEMP_BLOCK_203_0_113_1", "show ip interface GigabitEthernet0/0"], "rollback": ["no ip access-list extended TEMP_BLOCK_203_0_113_1", "interface GigabitEthernet0/0", " no ip access-group TEMP_BLOCK_203_0_113_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 203.0.113.1 at the edge interface GigabitEthernet0/0. Schedule auto-remove after investigation."}]}
{"instruction": "Contain suspected data exfiltration from inside host 192.168.0.1 to external 45.33.32.1", "config_raw": "interface GigabitEthernet0/0\n ip address 172.16.0.1 255.255.255.0\n ip nat inside\n!\ninterface GigabitEthernet0/3\n ip address 185.199.108.1 255.255.255.0\n ip nat outside\n!\nip nat inside source static 192.168.0.1 45.33.32.1\n", "wazuh_alert": {"type": "data_exfiltration", "src_ip": "192.168.0.1", "dst_ip": "45.33.32.1", "severity": "critical", "evidence": ["large_transfer", "unusual_protocol"]}, "gold_actions": [{"action_type": "containment", "commands": ["ip access-list extended EXFIL_BLOCK", " deny ip host 192.168.0.1 any", " permit ip any any", "interface GigabitEthernet0/0", " ip access-group EXFIL_BLOCK in"], "verify": ["show access-lists EXFIL_BLOCK"], "rollback": ["no ip access-list extended EXFIL_BLOCK"], "explain": "Blocks outbound traffic temporarily from the compromised internal host to prevent further data exfiltration. Host may lose network access."}]}
{"instruction": "Mitigate ICMP/UDP flood from 185.199.108.1 towards interface GigabitEthernet0/2", "config_raw": "interface GigabitEthernet0/2\n ip address 192.168.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "icmp_flood", "src_ip": "185.199.108.1", "severity": "high", "pps": 11504}, "gold_actions": [{"action_type": "mitigation", "commands": ["control-plane", " service-policy input LIMIT_ICMP", "policy-map LIMIT_ICMP", " class class-default", "  police 8000 conform-action transmit exceed-action drop"], "verify": ["show policy-map interface control-plane"], "rollback": ["no policy-map LIMIT_ICMP"], "explain": "Rate-limits ICMP on the control plane to protect device CPU from flood. Verify in lab prior to production."}]}
{"instruction": "Prevent ARP spoofing on interface GigabitEthernet0/0", "config_raw": "interface GigabitEthernet0/0\n ip address 192.168.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "arp_spoofing", "src_ip": "192.168.0.1", "severity": "medium"}, "gold_actions": [{"action_type": "hardening", "commands": ["interface GigabitEthernet0/0", " ip arp inspection trust", " ip dhcp snooping trust"], "verify": ["show ip arp inspection interfaces"], "rollback": ["interface GigabitEthernet0/0", " no ip arp inspection trust"], "explain": "Enable DAI and DHCP snooping to reduce ARP spoofing risk. Requires global DHCP snooping/DAI config."}]}
{"instruction": "Increase logging and forward suspicious events to SIEM", "config_raw": "logging host 192.0.2.1\nlogging trap informational\n!\n", "wazuh_alert": {"type": "suspicious_activity_high_volume", "src_ip": "192.0.2.1", "severity": "medium"}, "gold_actions": [{"action_type": "monitoring", "commands": ["logging host 203.0.113.1", "logging trap warning", "service timestamps log datetime msec"], "verify": ["show logging"], "rollback": [], "explain": "Increase logging verbosity and forward logs to SIEM for detailed analysis."}]}
{"instruction": "Mitigate repeated failed VPN negotiation attempts from 45.33.32.1", "config_raw": "crypto isakmp policy 10\n encr aes\n hash sha256\n authentication pre-share\n group 14\n!\n", "wazuh_alert": {"type": "vpn_bruteforce", "src_ip": "45.33.32.1", "severity": "high", "attempts": 60}, "gold_actions": [{"action_type": "mitigation", "commands": ["crypto isakmp policy 10", " set security-association lifetime seconds 3600", " isakmp deny 45.33.32.1"], "verify": ["show crypto isakmp sa"], "rollback": ["crypto isakmp policy 10", " no isakmp deny 45.33.32.1"], "explain": "Temporarily deny IKE negotiations from the offending IP and reduce SA lifetime. Validate with peers."}]}
{"instruction": "Mitigate SSH brute force from 203.0.113.1 and restrict VTY access to trusted networks", "config_raw": "ip ssh version 2\nline vty 0 4\n transport input ssh\n login local\n!\n", "wazuh_alert": {"type": "ssh_bruteforce", "src_ip": "203.0.113.1", "dst_ip": "192.168.0.1", "severity": "critical", "attempts": 117}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list standard SSH_ADMIN", " deny 203.0.113.1", " permit 192.168.0.0 0.0.255.255", "line vty 0 4", " access-class SSH_ADMIN in"], "verify": ["show access-lists SSH_ADMIN", "show line vty 0"], "rollback": ["no ip access-list standard SSH_ADMIN"], "explain": "Blocks attacker IP from accessing VTY and limits SSH access to known management networks. Verify that legitimate admins are within allowed range."}]}
{"instruction": "Harden weak console password and enable password encryption", "config_raw": "line con 0\n password cisco\n login\n!\n", "wazuh_alert": {"type": "weak_password_detected", "severity": "high", "evidence": ["default-password"]}, "gold_actions": [{"action_type": "hardening", "commands": ["line con 0", " password Stronger!Pass2025", " login local", " service password-encryption"], "verify": ["show running-config | section line con"], "rollback": ["line con 0", " password cisco"], "explain": "Replace default/weak console password with a stronger one, enable local login and encrypt stored passwords."}]}
{"instruction": "Block traffic from 198.51.100.1 at ingress on interface GigabitEthernet0/0", "config_raw": "interface GigabitEthernet0/0\n ip address 192.168.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "198.51.100.1", "dst_ip": "172.16.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_198_51_100_1", " deny ip host 198.51.100.1 any", " permit ip any any", "interface GigabitEthernet0/0", " ip access-group TEMP_BLOCK_198_51_100_1 in"], "verify": ["show access-lists TEMP_BLOCK_198_51_100_1", "show ip interface GigabitEthernet0/0"], "rollback": ["no ip access-list extended TEMP_BLOCK_198_51_100_1", "interface GigabitEthernet0/0", " no ip access-group TEMP_BLOCK_198_51_100_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 198.51.100.1 at the edge interface GigabitEthernet0/0. Schedule auto-remove after investigation."}]}
{"instruction": "Mitigate SSH brute force from 185.199.108.1 and restrict VTY access to trusted networks", "config_raw": "ip ssh version 2\nline vty 0 4\n transport input ssh\n login local\n!\n", "wazuh_alert": {"type": "ssh_bruteforce", "src_ip": "185.199.108.1", "dst_ip": "192.168.0.1", "severity": "critical", "attempts": 100}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list standard SSH_ADMIN", " deny 185.199.108.1", " permit 192.168.0.0 0.0.255.255", "line vty 0 4", " access-class SSH_ADMIN in"], "verify": ["show access-lists SSH_ADMIN", "show line vty 0"], "rollback": ["no ip access-list standard SSH_ADMIN"], "explain": "Blocks attacker IP from accessing VTY and limits SSH access to known management networks. Verify that legitimate admins are within allowed range."}]}
{"instruction": "Contain suspected data exfiltration from inside host 172.16.0.1 to external 198.51.100.1", "config_raw": "interface GigabitEthernet0/0\n ip address 172.16.0.1 255.255.255.0\n ip nat inside\n!\ninterface GigabitEthernet0/2\n ip address 203.0.113.1 255.255.255.0\n ip nat outside\n!\nip nat inside source static 172.16.0.1 198.51.100.1\n", "wazuh_alert": {"type": "data_exfiltration", "src_ip": "172.16.0.1", "dst_ip": "198.51.100.1", "severity": "critical", "evidence": ["large_transfer", "unusual_protocol"]}, "gold_actions": [{"action_type": "containment", "commands": ["ip access-list extended EXFIL_BLOCK", " deny ip host 172.16.0.1 any", " permit ip any any", "interface GigabitEthernet0/0", " ip access-group EXFIL_BLOCK in"], "verify": ["show access-lists EXFIL_BLOCK"], "rollback": ["no ip access-list extended EXFIL_BLOCK"], "explain": "Blocks outbound traffic temporarily from the compromised internal host to prevent further data exfiltration. Host may lose network access."}]}
{"instruction": "Prevent ARP spoofing on interface GigabitEthernet0/2", "config_raw": "interface GigabitEthernet0/2\n ip address 172.16.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "arp_spoofing", "src_ip": "10.0.0.1", "severity": "medium"}, "gold_actions": [{"action_type": "hardening", "commands": ["interface GigabitEthernet0/2", " ip arp inspection trust", " ip dhcp snooping trust"], "verify": ["show ip arp inspection interfaces"], "rollback": ["interface GigabitEthernet0/2", " no ip arp inspection trust"], "explain": "Enable DAI and DHCP snooping to reduce ARP spoofing risk. Requires global DHCP snooping/DAI config."}]}
{"instruction": "Prevent ARP spoofing on interface GigabitEthernet0/1", "config_raw": "interface GigabitEthernet0/1\n ip address 192.168.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "arp_spoofing", "src_ip": "10.0.0.1", "severity": "medium"}, "gold_actions": [{"action_type": "hardening", "commands": ["interface GigabitEthernet0/1", " ip arp inspection trust", " ip dhcp snooping trust"], "verify": ["show ip arp inspection interfaces"], "rollback": ["interface GigabitEthernet0/1", " no ip arp inspection trust"], "explain": "Enable DAI and DHCP snooping to reduce ARP spoofing risk. Requires global DHCP snooping/DAI config."}]}
{"instruction": "Prevent ARP spoofing on interface GigabitEthernet0/3", "config_raw": "interface GigabitEthernet0/3\n ip address 10.0.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "arp_spoofing", "src_ip": "192.168.0.1", "severity": "medium"}, "gold_actions": [{"action_type": "hardening", "commands": ["interface GigabitEthernet0/3", " ip arp inspection trust", " ip dhcp snooping trust"], "verify": ["show ip arp inspection interfaces"], "rollback": ["interface GigabitEthernet0/3", " no ip arp inspection trust"], "explain": "Enable DAI and DHCP snooping to reduce ARP spoofing risk. Requires global DHCP snooping/DAI config."}]}
{"instruction": "Block traffic from 198.51.100.1 at ingress on interface GigabitEthernet0/1", "config_raw": "interface GigabitEthernet0/1\n ip address 192.168.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "198.51.100.1", "dst_ip": "172.16.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_198_51_100_1", " deny ip host 198.51.100.1 any", " permit ip any any", "interface GigabitEthernet0/1", " ip access-group TEMP_BLOCK_198_51_100_1 in"], "verify": ["show access-lists TEMP_BLOCK_198_51_100_1", "show ip interface GigabitEthernet0/1"], "rollback": ["no ip access-list extended TEMP_BLOCK_198_51_100_1", "interface GigabitEthernet0/1", " no ip access-group TEMP_BLOCK_198_51_100_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 198.51.100.1 at the edge interface GigabitEthernet0/1. Schedule auto-remove after investigation."}]}
{"instruction": "Block traffic from 198.51.100.1 at ingress on interface GigabitEthernet0/2", "config_raw": "interface GigabitEthernet0/2\n ip address 192.168.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "198.51.100.1", "dst_ip": "192.168.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_198_51_100_1", " deny ip host 198.51.100.1 any", " permit ip any any", "interface GigabitEthernet0/2", " ip access-group TEMP_BLOCK_198_51_100_1 in"], "verify": ["show access-lists TEMP_BLOCK_198_51_100_1", "show ip interface GigabitEthernet0/2"], "rollback": ["no ip access-list extended TEMP_BLOCK_198_51_100_1", "interface GigabitEthernet0/2", " no ip access-group TEMP_BLOCK_198_51_100_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 198.51.100.1 at the edge interface GigabitEthernet0/2. Schedule auto-remove after investigation."}]}
{"instruction": "Block traffic from 198.51.100.1 at ingress on interface GigabitEthernet0/1", "config_raw": "interface GigabitEthernet0/1\n ip address 192.168.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "198.51.100.1", "dst_ip": "172.16.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_198_51_100_1", " deny ip host 198.51.100.1 any", " permit ip any any", "interface GigabitEthernet0/1", " ip access-group TEMP_BLOCK_198_51_100_1 in"], "verify": ["show access-lists TEMP_BLOCK_198_51_100_1", "show ip interface GigabitEthernet0/1"], "rollback": ["no ip access-list extended TEMP_BLOCK_198_51_100_1", "interface GigabitEthernet0/1", " no ip access-group TEMP_BLOCK_198_51_100_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 198.51.100.1 at the edge interface GigabitEthernet0/1. Schedule auto-remove after investigation."}]}
{"instruction": "Protect OSPF domain from neighbor spoofing on GigabitEthernet0/2", "config_raw": "router ospf 57\n network 192.168.0.1 0.0.0.255 area 0\n!\ninterface GigabitEthernet0/2\n ip address 172.16.0.1 255.255.255.0\n!", "wazuh_alert": {"type": "ospf_neighbor_spoofing", "src_ip": "10.0.0.1", "dst_ip": "10.0.0.1", "severity": "high"}, "gold_actions": [{"action_type": "protection", "commands": ["router ospf 1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 StrongKey123"], "verify": ["show ip ospf neighbor", "show ip ospf interface"], "rollback": ["router ospf 1", " no ip ospf authentication message-digest"], "explain": "Enable MD5 authentication for OSPF to prevent bogus neighbor formation. Ensure matching keys on all peers."}]}
{"instruction": "Harden weak console password and enable password encryption", "config_raw": "line con 0\n password cisco\n login\n!\n", "wazuh_alert": {"type": "weak_password_detected", "severity": "high", "evidence": ["default-password"]}, "gold_actions": [{"action_type": "hardening", "commands": ["line con 0", " password Stronger!Pass2025", " login local", " service password-encryption"], "verify": ["show running-config | section line con"], "rollback": ["line con 0", " password cisco"], "explain": "Replace default/weak console password with a stronger one, enable local login and encrypt stored passwords."}]}
{"instruction": "Block traffic from 192.0.2.1 at ingress on interface GigabitEthernet0/0", "config_raw": "interface GigabitEthernet0/0\n ip address 192.168.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "192.0.2.1", "dst_ip": "192.168.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_192_0_2_1", " deny ip host 192.0.2.1 any", " permit ip any any", "interface GigabitEthernet0/0", " ip access-group TEMP_BLOCK_192_0_2_1 in"], "verify": ["show access-lists TEMP_BLOCK_192_0_2_1", "show ip interface GigabitEthernet0/0"], "rollback": ["no ip access-list extended TEMP_BLOCK_192_0_2_1", "interface GigabitEthernet0/0", " no ip access-group TEMP_BLOCK_192_0_2_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 192.0.2.1 at the edge interface GigabitEthernet0/0. Schedule auto-remove after investigation."}]}
{"instruction": "Contain suspected data exfiltration from inside host 192.168.0.1 to external 198.51.100.1", "config_raw": "interface GigabitEthernet0/0\n ip address 192.168.0.1 255.255.255.0\n ip nat inside\n!\ninterface GigabitEthernet0/0\n ip address 203.0.113.1 255.255.255.0\n ip nat outside\n!\nip nat inside source static 192.168.0.1 198.51.100.1\n", "wazuh_alert": {"type": "data_exfiltration", "src_ip": "192.168.0.1", "dst_ip": "198.51.100.1", "severity": "critical", "evidence": ["large_transfer", "unusual_protocol"]}, "gold_actions": [{"action_type": "containment", "commands": ["ip access-list extended EXFIL_BLOCK", " deny ip host 192.168.0.1 any", " permit ip any any", "interface GigabitEthernet0/0", " ip access-group EXFIL_BLOCK in"], "verify": ["show access-lists EXFIL_BLOCK"], "rollback": ["no ip access-list extended EXFIL_BLOCK"], "explain": "Blocks outbound traffic temporarily from the compromised internal host to prevent further data exfiltration. Host may lose network access."}]}
{"instruction": "Contain suspected data exfiltration from inside host 10.0.0.1 to external 203.0.113.1", "config_raw": "interface GigabitEthernet0/2\n ip address 192.168.0.1 255.255.255.0\n ip nat inside\n!\ninterface GigabitEthernet0/0\n ip address 198.51.100.1 255.255.255.0\n ip nat outside\n!\nip nat inside source static 10.0.0.1 203.0.113.1\n", "wazuh_alert": {"type": "data_exfiltration", "src_ip": "10.0.0.1", "dst_ip": "203.0.113.1", "severity": "critical", "evidence": ["large_transfer", "unusual_protocol"]}, "gold_actions": [{"action_type": "containment", "commands": ["ip access-list extended EXFIL_BLOCK", " deny ip host 10.0.0.1 any", " permit ip any any", "interface GigabitEthernet0/2", " ip access-group EXFIL_BLOCK in"], "verify": ["show access-lists EXFIL_BLOCK"], "rollback": ["no ip access-list extended EXFIL_BLOCK"], "explain": "Blocks outbound traffic temporarily from the compromised internal host to prevent further data exfiltration. Host may lose network access."}]}
{"instruction": "Protect OSPF domain from neighbor spoofing on GigabitEthernet0/3", "config_raw": "router ospf 28\n network 192.168.0.1 0.0.0.255 area 0\n!\ninterface GigabitEthernet0/3\n ip address 10.0.0.1 255.255.255.0\n!", "wazuh_alert": {"type": "ospf_neighbor_spoofing", "src_ip": "192.168.0.1", "dst_ip": "192.168.0.1", "severity": "high"}, "gold_actions": [{"action_type": "protection", "commands": ["router ospf 1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 StrongKey123"], "verify": ["show ip ospf neighbor", "show ip ospf interface"], "rollback": ["router ospf 1", " no ip ospf authentication message-digest"], "explain": "Enable MD5 authentication for OSPF to prevent bogus neighbor formation. Ensure matching keys on all peers."}]}
{"instruction": "Increase logging and forward suspicious events to SIEM", "config_raw": "logging host 198.51.100.1\nlogging trap informational\n!\n", "wazuh_alert": {"type": "suspicious_activity_high_volume", "src_ip": "45.33.32.1", "severity": "medium"}, "gold_actions": [{"action_type": "monitoring", "commands": ["logging host 45.33.32.1", "logging trap warning", "service timestamps log datetime msec"], "verify": ["show logging"], "rollback": [], "explain": "Increase logging verbosity and forward logs to SIEM for detailed analysis."}]}
{"instruction": "Block traffic from 198.51.100.1 at ingress on interface GigabitEthernet0/0", "config_raw": "interface GigabitEthernet0/0\n ip address 10.0.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "198.51.100.1", "dst_ip": "192.168.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_198_51_100_1", " deny ip host 198.51.100.1 any", " permit ip any any", "interface GigabitEthernet0/0", " ip access-group TEMP_BLOCK_198_51_100_1 in"], "verify": ["show access-lists TEMP_BLOCK_198_51_100_1", "show ip interface GigabitEthernet0/0"], "rollback": ["no ip access-list extended TEMP_BLOCK_198_51_100_1", "interface GigabitEthernet0/0", " no ip access-group TEMP_BLOCK_198_51_100_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 198.51.100.1 at the edge interface GigabitEthernet0/0. Schedule auto-remove after investigation."}]}
{"instruction": "Contain suspected data exfiltration from inside host 172.16.0.1 to external 45.33.32.1", "config_raw": "interface GigabitEthernet0/3\n ip address 192.168.0.1 255.255.255.0\n ip nat inside\n!\ninterface GigabitEthernet0/3\n ip address 203.0.113.1 255.255.255.0\n ip nat outside\n!\nip nat inside source static 172.16.0.1 45.33.32.1\n", "wazuh_alert": {"type": "data_exfiltration", "src_ip": "172.16.0.1", "dst_ip": "45.33.32.1", "severity": "critical", "evidence": ["large_transfer", "unusual_protocol"]}, "gold_actions": [{"action_type": "containment", "commands": ["ip access-list extended EXFIL_BLOCK", " deny ip host 172.16.0.1 any", " permit ip any any", "interface GigabitEthernet0/3", " ip access-group EXFIL_BLOCK in"], "verify": ["show access-lists EXFIL_BLOCK"], "rollback": ["no ip access-list extended EXFIL_BLOCK"], "explain": "Blocks outbound traffic temporarily from the compromised internal host to prevent further data exfiltration. Host may lose network access."}]}
{"instruction": "Mitigate repeated failed VPN negotiation attempts from 203.0.113.1", "config_raw": "crypto isakmp policy 10\n encr aes\n hash sha256\n authentication pre-share\n group 14\n!\n", "wazuh_alert": {"type": "vpn_bruteforce", "src_ip": "203.0.113.1", "severity": "high", "attempts": 35}, "gold_actions": [{"action_type": "mitigation", "commands": ["crypto isakmp policy 10", " set security-association lifetime seconds 3600", " isakmp deny 203.0.113.1"], "verify": ["show crypto isakmp sa"], "rollback": ["crypto isakmp policy 10", " no isakmp deny 203.0.113.1"], "explain": "Temporarily deny IKE negotiations from the offending IP and reduce SA lifetime. Validate with peers."}]}
{"instruction": "Protect OSPF domain from neighbor spoofing on GigabitEthernet0/2", "config_raw": "router ospf 14\n network 10.0.0.1 0.0.0.255 area 0\n!\ninterface GigabitEthernet0/2\n ip address 10.0.0.1 255.255.255.0\n!", "wazuh_alert": {"type": "ospf_neighbor_spoofing", "src_ip": "10.0.0.1", "dst_ip": "192.168.0.1", "severity": "high"}, "gold_actions": [{"action_type": "protection", "commands": ["router ospf 1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 StrongKey123"], "verify": ["show ip ospf neighbor", "show ip ospf interface"], "rollback": ["router ospf 1", " no ip ospf authentication message-digest"], "explain": "Enable MD5 authentication for OSPF to prevent bogus neighbor formation. Ensure matching keys on all peers."}]}
{"instruction": "Mitigate ICMP/UDP flood from 198.51.100.1 towards interface GigabitEthernet0/3", "config_raw": "interface GigabitEthernet0/3\n ip address 10.0.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "icmp_flood", "src_ip": "198.51.100.1", "severity": "high", "pps": 46509}, "gold_actions": [{"action_type": "mitigation", "commands": ["control-plane", " service-policy input LIMIT_ICMP", "policy-map LIMIT_ICMP", " class class-default", "  police 8000 conform-action transmit exceed-action drop"], "verify": ["show policy-map interface control-plane"], "rollback": ["no policy-map LIMIT_ICMP"], "explain": "Rate-limits ICMP on the control plane to protect device CPU from flood. Verify in lab prior to production."}]}
{"instruction": "Mitigate ICMP/UDP flood from 198.51.100.1 towards interface GigabitEthernet0/0", "config_raw": "interface GigabitEthernet0/0\n ip address 172.16.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "icmp_flood", "src_ip": "198.51.100.1", "severity": "high", "pps": 82132}, "gold_actions": [{"action_type": "mitigation", "commands": ["control-plane", " service-policy input LIMIT_ICMP", "policy-map LIMIT_ICMP", " class class-default", "  police 8000 conform-action transmit exceed-action drop"], "verify": ["show policy-map interface control-plane"], "rollback": ["no policy-map LIMIT_ICMP"], "explain": "Rate-limits ICMP on the control plane to protect device CPU from flood. Verify in lab prior to production."}]}
{"instruction": "Mitigate repeated failed VPN negotiation attempts from 203.0.113.1", "config_raw": "crypto isakmp policy 10\n encr aes\n hash sha256\n authentication pre-share\n group 14\n!\n", "wazuh_alert": {"type": "vpn_bruteforce", "src_ip": "203.0.113.1", "severity": "high", "attempts": 186}, "gold_actions": [{"action_type": "mitigation", "commands": ["crypto isakmp policy 10", " set security-association lifetime seconds 3600", " isakmp deny 203.0.113.1"], "verify": ["show crypto isakmp sa"], "rollback": ["crypto isakmp policy 10", " no isakmp deny 203.0.113.1"], "explain": "Temporarily deny IKE negotiations from the offending IP and reduce SA lifetime. Validate with peers."}]}
{"instruction": "Mitigate SSH brute force from 203.0.113.1 and restrict VTY access to trusted networks", "config_raw": "ip ssh version 2\nline vty 0 4\n transport input ssh\n login local\n!\n", "wazuh_alert": {"type": "ssh_bruteforce", "src_ip": "203.0.113.1", "dst_ip": "10.0.0.1", "severity": "critical", "attempts": 110}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list standard SSH_ADMIN", " deny 203.0.113.1", " permit 192.168.0.0 0.0.255.255", "line vty 0 4", " access-class SSH_ADMIN in"], "verify": ["show access-lists SSH_ADMIN", "show line vty 0"], "rollback": ["no ip access-list standard SSH_ADMIN"], "explain": "Blocks attacker IP from accessing VTY and limits SSH access to known management networks. Verify that legitimate admins are within allowed range."}]}
{"instruction": "Mitigate SSH brute force from 45.33.32.1 and restrict VTY access to trusted networks", "config_raw": "ip ssh version 2\nline vty 0 4\n transport input ssh\n login local\n!\n", "wazuh_alert": {"type": "ssh_bruteforce", "src_ip": "45.33.32.1", "dst_ip": "172.16.0.1", "severity": "critical", "attempts": 173}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list standard SSH_ADMIN", " deny 45.33.32.1", " permit 192.168.0.0 0.0.255.255", "line vty 0 4", " access-class SSH_ADMIN in"], "verify": ["show access-lists SSH_ADMIN", "show line vty 0"], "rollback": ["no ip access-list standard SSH_ADMIN"], "explain": "Blocks attacker IP from accessing VTY and limits SSH access to known management networks. Verify that legitimate admins are within allowed range."}]}
{"instruction": "Mitigate SSH brute force from 45.33.32.1 and restrict VTY access to trusted networks", "config_raw": "ip ssh version 2\nline vty 0 4\n transport input ssh\n login local\n!\n", "wazuh_alert": {"type": "ssh_bruteforce", "src_ip": "45.33.32.1", "dst_ip": "10.0.0.1", "severity": "critical", "attempts": 92}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list standard SSH_ADMIN", " deny 45.33.32.1", " permit 192.168.0.0 0.0.255.255", "line vty 0 4", " access-class SSH_ADMIN in"], "verify": ["show access-lists SSH_ADMIN", "show line vty 0"], "rollback": ["no ip access-list standard SSH_ADMIN"], "explain": "Blocks attacker IP from accessing VTY and limits SSH access to known management networks. Verify that legitimate admins are within allowed range."}]}
{"instruction": "Block traffic from 203.0.113.1 at ingress on interface GigabitEthernet0/3", "config_raw": "interface GigabitEthernet0/3\n ip address 172.16.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "203.0.113.1", "dst_ip": "172.16.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_203_0_113_1", " deny ip host 203.0.113.1 any", " permit ip any any", "interface GigabitEthernet0/3", " ip access-group TEMP_BLOCK_203_0_113_1 in"], "verify": ["show access-lists TEMP_BLOCK_203_0_113_1", "show ip interface GigabitEthernet0/3"], "rollback": ["no ip access-list extended TEMP_BLOCK_203_0_113_1", "interface GigabitEthernet0/3", " no ip access-group TEMP_BLOCK_203_0_113_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 203.0.113.1 at the edge interface GigabitEthernet0/3. Schedule auto-remove after investigation."}]}
{"instruction": "Respond to suspected BGP route injection originating via peer 45.33.32.1", "config_raw": "router bgp 64583\n neighbor 45.33.32.1 remote-as 65189\n!\n", "wazuh_alert": {"type": "bgp_route_injection", "src_ip": "45.33.32.1", "severity": "critical", "evidence": ["unexpected-prefixes"]}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip prefix-list BLOCK_UNEXPECTED seq 5 deny 0.0.0.0/0 le 32", "router bgp 64512", " neighbor 45.33.32.1 route-map FILTER_IN in"], "verify": ["show ip bgp neighbors", "show ip route"], "rollback": ["no ip prefix-list BLOCK_UNEXPECTED", "router bgp 64512", " no neighbor 45.33.32.1 route-map FILTER_IN in"], "explain": "Apply inbound route filters to prevent acceptance of suspicious prefixes from the peer. Requires careful prefix-list tailoring."}]}
{"instruction": "Block traffic from 45.33.32.1 at ingress on interface GigabitEthernet0/1", "config_raw": "interface GigabitEthernet0/1\n ip address 10.0.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "45.33.32.1", "dst_ip": "172.16.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_45_33_32_1", " deny ip host 45.33.32.1 any", " permit ip any any", "interface GigabitEthernet0/1", " ip access-group TEMP_BLOCK_45_33_32_1 in"], "verify": ["show access-lists TEMP_BLOCK_45_33_32_1", "show ip interface GigabitEthernet0/1"], "rollback": ["no ip access-list extended TEMP_BLOCK_45_33_32_1", "interface GigabitEthernet0/1", " no ip access-group TEMP_BLOCK_45_33_32_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 45.33.32.1 at the edge interface GigabitEthernet0/1. Schedule auto-remove after investigation."}]}
{"instruction": "Mitigate SSH brute force from 203.0.113.1 and restrict VTY access to trusted networks", "config_raw": "ip ssh version 2\nline vty 0 4\n transport input ssh\n login local\n!\n", "wazuh_alert": {"type": "ssh_bruteforce", "src_ip": "203.0.113.1", "dst_ip": "192.168.0.1", "severity": "critical", "attempts": 188}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list standard SSH_ADMIN", " deny 203.0.113.1", " permit 192.168.0.0 0.0.255.255", "line vty 0 4", " access-class SSH_ADMIN in"], "verify": ["show access-lists SSH_ADMIN", "show line vty 0"], "rollback": ["no ip access-list standard SSH_ADMIN"], "explain": "Blocks attacker IP from accessing VTY and limits SSH access to known management networks. Verify that legitimate admins are within allowed range."}]}
{"instruction": "Prevent ARP spoofing on interface GigabitEthernet0/2", "config_raw": "interface GigabitEthernet0/2\n ip address 10.0.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "arp_spoofing", "src_ip": "10.0.0.1", "severity": "medium"}, "gold_actions": [{"action_type": "hardening", "commands": ["interface GigabitEthernet0/2", " ip arp inspection trust", " ip dhcp snooping trust"], "verify": ["show ip arp inspection interfaces"], "rollback": ["interface GigabitEthernet0/2", " no ip arp inspection trust"], "explain": "Enable DAI and DHCP snooping to reduce ARP spoofing risk. Requires global DHCP snooping/DAI config."}]}
{"instruction": "Mitigate repeated failed VPN negotiation attempts from 45.33.32.1", "config_raw": "crypto isakmp policy 10\n encr aes\n hash sha256\n authentication pre-share\n group 14\n!\n", "wazuh_alert": {"type": "vpn_bruteforce", "src_ip": "45.33.32.1", "severity": "high", "attempts": 148}, "gold_actions": [{"action_type": "mitigation", "commands": ["crypto isakmp policy 10", " set security-association lifetime seconds 3600", " isakmp deny 45.33.32.1"], "verify": ["show crypto isakmp sa"], "rollback": ["crypto isakmp policy 10", " no isakmp deny 45.33.32.1"], "explain": "Temporarily deny IKE negotiations from the offending IP and reduce SA lifetime. Validate with peers."}]}
{"instruction": "Protect OSPF domain from neighbor spoofing on GigabitEthernet0/1", "config_raw": "router ospf 8\n network 192.168.0.1 0.0.0.255 area 0\n!\ninterface GigabitEthernet0/1\n ip address 10.0.0.1 255.255.255.0\n!", "wazuh_alert": {"type": "ospf_neighbor_spoofing", "src_ip": "10.0.0.1", "dst_ip": "10.0.0.1", "severity": "high"}, "gold_actions": [{"action_type": "protection", "commands": ["router ospf 1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 StrongKey123"], "verify": ["show ip ospf neighbor", "show ip ospf interface"], "rollback": ["router ospf 1", " no ip ospf authentication message-digest"], "explain": "Enable MD5 authentication for OSPF to prevent bogus neighbor formation. Ensure matching keys on all peers."}]}
{"instruction": "Mitigate SSH brute force from 203.0.113.1 and restrict VTY access to trusted networks", "config_raw": "ip ssh version 2\nline vty 0 4\n transport input ssh\n login local\n!\n", "wazuh_alert": {"type": "ssh_bruteforce", "src_ip": "203.0.113.1", "dst_ip": "192.168.0.1", "severity": "critical", "attempts": 110}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list standard SSH_ADMIN", " deny 203.0.113.1", " permit 192.168.0.0 0.0.255.255", "line vty 0 4", " access-class SSH_ADMIN in"], "verify": ["show access-lists SSH_ADMIN", "show line vty 0"], "rollback": ["no ip access-list standard SSH_ADMIN"], "explain": "Blocks attacker IP from accessing VTY and limits SSH access to known management networks. Verify that legitimate admins are within allowed range."}]}
{"instruction": "Protect OSPF domain from neighbor spoofing on GigabitEthernet0/0", "config_raw": "router ospf 73\n network 10.0.0.1 0.0.0.255 area 0\n!\ninterface GigabitEthernet0/0\n ip address 192.168.0.1 255.255.255.0\n!", "wazuh_alert": {"type": "ospf_neighbor_spoofing", "src_ip": "192.168.0.1", "dst_ip": "10.0.0.1", "severity": "high"}, "gold_actions": [{"action_type": "protection", "commands": ["router ospf 1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 StrongKey123"], "verify": ["show ip ospf neighbor", "show ip ospf interface"], "rollback": ["router ospf 1", " no ip ospf authentication message-digest"], "explain": "Enable MD5 authentication for OSPF to prevent bogus neighbor formation. Ensure matching keys on all peers."}]}
{"instruction": "Prevent ARP spoofing on interface GigabitEthernet0/0", "config_raw": "interface GigabitEthernet0/0\n ip address 172.16.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "arp_spoofing", "src_ip": "192.168.0.1", "severity": "medium"}, "gold_actions": [{"action_type": "hardening", "commands": ["interface GigabitEthernet0/0", " ip arp inspection trust", " ip dhcp snooping trust"], "verify": ["show ip arp inspection interfaces"], "rollback": ["interface GigabitEthernet0/0", " no ip arp inspection trust"], "explain": "Enable DAI and DHCP snooping to reduce ARP spoofing risk. Requires global DHCP snooping/DAI config."}]}
{"instruction": "Mitigate repeated failed VPN negotiation attempts from 185.199.108.1", "config_raw": "crypto isakmp policy 10\n encr aes\n hash sha256\n authentication pre-share\n group 14\n!\n", "wazuh_alert": {"type": "vpn_bruteforce", "src_ip": "185.199.108.1", "severity": "high", "attempts": 153}, "gold_actions": [{"action_type": "mitigation", "commands": ["crypto isakmp policy 10", " set security-association lifetime seconds 3600", " isakmp deny 185.199.108.1"], "verify": ["show crypto isakmp sa"], "rollback": ["crypto isakmp policy 10", " no isakmp deny 185.199.108.1"], "explain": "Temporarily deny IKE negotiations from the offending IP and reduce SA lifetime. Validate with peers."}]}
{"instruction": "Contain suspected data exfiltration from inside host 172.16.0.1 to external 198.51.100.1", "config_raw": "interface GigabitEthernet0/2\n ip address 172.16.0.1 255.255.255.0\n ip nat inside\n!\ninterface GigabitEthernet0/1\n ip address 45.33.32.1 255.255.255.0\n ip nat outside\n!\nip nat inside source static 172.16.0.1 198.51.100.1\n", "wazuh_alert": {"type": "data_exfiltration", "src_ip": "172.16.0.1", "dst_ip": "198.51.100.1", "severity": "critical", "evidence": ["large_transfer", "unusual_protocol"]}, "gold_actions": [{"action_type": "containment", "commands": ["ip access-list extended EXFIL_BLOCK", " deny ip host 172.16.0.1 any", " permit ip any any", "interface GigabitEthernet0/2", " ip access-group EXFIL_BLOCK in"], "verify": ["show access-lists EXFIL_BLOCK"], "rollback": ["no ip access-list extended EXFIL_BLOCK"], "explain": "Blocks outbound traffic temporarily from the compromised internal host to prevent further data exfiltration. Host may lose network access."}]}
{"instruction": "Protect OSPF domain from neighbor spoofing on GigabitEthernet0/2", "config_raw": "router ospf 59\n network 172.16.0.1 0.0.0.255 area 0\n!\ninterface GigabitEthernet0/2\n ip address 10.0.0.1 255.255.255.0\n!", "wazuh_alert": {"type": "ospf_neighbor_spoofing", "src_ip": "10.0.0.1", "dst_ip": "172.16.0.1", "severity": "high"}, "gold_actions": [{"action_type": "protection", "commands": ["router ospf 1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 StrongKey123"], "verify": ["show ip ospf neighbor", "show ip ospf interface"], "rollback": ["router ospf 1", " no ip ospf authentication message-digest"], "explain": "Enable MD5 authentication for OSPF to prevent bogus neighbor formation. Ensure matching keys on all peers."}]}
{"instruction": "Prevent ARP spoofing on interface GigabitEthernet0/0", "config_raw": "interface GigabitEthernet0/0\n ip address 10.0.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "arp_spoofing", "src_ip": "192.168.0.1", "severity": "medium"}, "gold_actions": [{"action_type": "hardening", "commands": ["interface GigabitEthernet0/0", " ip arp inspection trust", " ip dhcp snooping trust"], "verify": ["show ip arp inspection interfaces"], "rollback": ["interface GigabitEthernet0/0", " no ip arp inspection trust"], "explain": "Enable DAI and DHCP snooping to reduce ARP spoofing risk. Requires global DHCP snooping/DAI config."}]}
{"instruction": "Mitigate SSH brute force from 185.199.108.1 and restrict VTY access to trusted networks", "config_raw": "ip ssh version 2\nline vty 0 4\n transport input ssh\n login local\n!\n", "wazuh_alert": {"type": "ssh_bruteforce", "src_ip": "185.199.108.1", "dst_ip": "172.16.0.1", "severity": "critical", "attempts": 83}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list standard SSH_ADMIN", " deny 185.199.108.1", " permit 192.168.0.0 0.0.255.255", "line vty 0 4", " access-class SSH_ADMIN in"], "verify": ["show access-lists SSH_ADMIN", "show line vty 0"], "rollback": ["no ip access-list standard SSH_ADMIN"], "explain": "Blocks attacker IP from accessing VTY and limits SSH access to known management networks. Verify that legitimate admins are within allowed range."}]}
{"instruction": "Block traffic from 203.0.113.1 at ingress on interface GigabitEthernet0/1", "config_raw": "interface GigabitEthernet0/1\n ip address 172.16.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "203.0.113.1", "dst_ip": "172.16.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_203_0_113_1", " deny ip host 203.0.113.1 any", " permit ip any any", "interface GigabitEthernet0/1", " ip access-group TEMP_BLOCK_203_0_113_1 in"], "verify": ["show access-lists TEMP_BLOCK_203_0_113_1", "show ip interface GigabitEthernet0/1"], "rollback": ["no ip access-list extended TEMP_BLOCK_203_0_113_1", "interface GigabitEthernet0/1", " no ip access-group TEMP_BLOCK_203_0_113_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 203.0.113.1 at the edge interface GigabitEthernet0/1. Schedule auto-remove after investigation."}]}
{"instruction": "Contain suspected data exfiltration from inside host 172.16.0.1 to external 185.199.108.1", "config_raw": "interface GigabitEthernet0/2\n ip address 192.168.0.1 255.255.255.0\n ip nat inside\n!\ninterface GigabitEthernet0/0\n ip address 185.199.108.1 255.255.255.0\n ip nat outside\n!\nip nat inside source static 172.16.0.1 185.199.108.1\n", "wazuh_alert": {"type": "data_exfiltration", "src_ip": "172.16.0.1", "dst_ip": "185.199.108.1", "severity": "critical", "evidence": ["large_transfer", "unusual_protocol"]}, "gold_actions": [{"action_type": "containment", "commands": ["ip access-list extended EXFIL_BLOCK", " deny ip host 172.16.0.1 any", " permit ip any any", "interface GigabitEthernet0/2", " ip access-group EXFIL_BLOCK in"], "verify": ["show access-lists EXFIL_BLOCK"], "rollback": ["no ip access-list extended EXFIL_BLOCK"], "explain": "Blocks outbound traffic temporarily from the compromised internal host to prevent further data exfiltration. Host may lose network access."}]}
{"instruction": "Harden weak console password and enable password encryption", "config_raw": "line con 0\n password cisco\n login\n!\n", "wazuh_alert": {"type": "weak_password_detected", "severity": "high", "evidence": ["default-password"]}, "gold_actions": [{"action_type": "hardening", "commands": ["line con 0", " password Stronger!Pass2025", " login local", " service password-encryption"], "verify": ["show running-config | section line con"], "rollback": ["line con 0", " password cisco"], "explain": "Replace default/weak console password with a stronger one, enable local login and encrypt stored passwords."}]}
{"instruction": "Respond to suspected BGP route injection originating via peer 203.0.113.1", "config_raw": "router bgp 64529\n neighbor 203.0.113.1 remote-as 64782\n!\n", "wazuh_alert": {"type": "bgp_route_injection", "src_ip": "203.0.113.1", "severity": "critical", "evidence": ["unexpected-prefixes"]}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip prefix-list BLOCK_UNEXPECTED seq 5 deny 0.0.0.0/0 le 32", "router bgp 64512", " neighbor 203.0.113.1 route-map FILTER_IN in"], "verify": ["show ip bgp neighbors", "show ip route"], "rollback": ["no ip prefix-list BLOCK_UNEXPECTED", "router bgp 64512", " no neighbor 203.0.113.1 route-map FILTER_IN in"], "explain": "Apply inbound route filters to prevent acceptance of suspicious prefixes from the peer. Requires careful prefix-list tailoring."}]}
{"instruction": "Prevent ARP spoofing on interface GigabitEthernet0/0", "config_raw": "interface GigabitEthernet0/0\n ip address 192.168.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "arp_spoofing", "src_ip": "192.168.0.1", "severity": "medium"}, "gold_actions": [{"action_type": "hardening", "commands": ["interface GigabitEthernet0/0", " ip arp inspection trust", " ip dhcp snooping trust"], "verify": ["show ip arp inspection interfaces"], "rollback": ["interface GigabitEthernet0/0", " no ip arp inspection trust"], "explain": "Enable DAI and DHCP snooping to reduce ARP spoofing risk. Requires global DHCP snooping/DAI config."}]}
{"instruction": "Contain suspected data exfiltration from inside host 172.16.0.1 to external 192.0.2.1", "config_raw": "interface GigabitEthernet0/1\n ip address 10.0.0.1 255.255.255.0\n ip nat inside\n!\ninterface GigabitEthernet0/2\n ip address 192.0.2.1 255.255.255.0\n ip nat outside\n!\nip nat inside source static 172.16.0.1 192.0.2.1\n", "wazuh_alert": {"type": "data_exfiltration", "src_ip": "172.16.0.1", "dst_ip": "192.0.2.1", "severity": "critical", "evidence": ["large_transfer", "unusual_protocol"]}, "gold_actions": [{"action_type": "containment", "commands": ["ip access-list extended EXFIL_BLOCK", " deny ip host 172.16.0.1 any", " permit ip any any", "interface GigabitEthernet0/1", " ip access-group EXFIL_BLOCK in"], "verify": ["show access-lists EXFIL_BLOCK"], "rollback": ["no ip access-list extended EXFIL_BLOCK"], "explain": "Blocks outbound traffic temporarily from the compromised internal host to prevent further data exfiltration. Host may lose network access."}]}
{"instruction": "Harden weak console password and enable password encryption", "config_raw": "line con 0\n password cisco\n login\n!\n", "wazuh_alert": {"type": "weak_password_detected", "severity": "high", "evidence": ["default-password"]}, "gold_actions": [{"action_type": "hardening", "commands": ["line con 0", " password Stronger!Pass2025", " login local", " service password-encryption"], "verify": ["show running-config | section line con"], "rollback": ["line con 0", " password cisco"], "explain": "Replace default/weak console password with a stronger one, enable local login and encrypt stored passwords."}]}
{"instruction": "Block traffic from 192.0.2.1 at ingress on interface GigabitEthernet0/0", "config_raw": "interface GigabitEthernet0/0\n ip address 10.0.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "192.0.2.1", "dst_ip": "192.168.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_192_0_2_1", " deny ip host 192.0.2.1 any", " permit ip any any", "interface GigabitEthernet0/0", " ip access-group TEMP_BLOCK_192_0_2_1 in"], "verify": ["show access-lists TEMP_BLOCK_192_0_2_1", "show ip interface GigabitEthernet0/0"], "rollback": ["no ip access-list extended TEMP_BLOCK_192_0_2_1", "interface GigabitEthernet0/0", " no ip access-group TEMP_BLOCK_192_0_2_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 192.0.2.1 at the edge interface GigabitEthernet0/0. Schedule auto-remove after investigation."}]}
{"instruction": "Block traffic from 192.0.2.1 at ingress on interface GigabitEthernet0/0", "config_raw": "interface GigabitEthernet0/0\n ip address 10.0.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "192.0.2.1", "dst_ip": "172.16.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_192_0_2_1", " deny ip host 192.0.2.1 any", " permit ip any any", "interface GigabitEthernet0/0", " ip access-group TEMP_BLOCK_192_0_2_1 in"], "verify": ["show access-lists TEMP_BLOCK_192_0_2_1", "show ip interface GigabitEthernet0/0"], "rollback": ["no ip access-list extended TEMP_BLOCK_192_0_2_1", "interface GigabitEthernet0/0", " no ip access-group TEMP_BLOCK_192_0_2_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 192.0.2.1 at the edge interface GigabitEthernet0/0. Schedule auto-remove after investigation."}]}
{"instruction": "Block traffic from 198.51.100.1 at ingress on interface GigabitEthernet0/2", "config_raw": "interface GigabitEthernet0/2\n ip address 10.0.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "198.51.100.1", "dst_ip": "192.168.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_198_51_100_1", " deny ip host 198.51.100.1 any", " permit ip any any", "interface GigabitEthernet0/2", " ip access-group TEMP_BLOCK_198_51_100_1 in"], "verify": ["show access-lists TEMP_BLOCK_198_51_100_1", "show ip interface GigabitEthernet0/2"], "rollback": ["no ip access-list extended TEMP_BLOCK_198_51_100_1", "interface GigabitEthernet0/2", " no ip access-group TEMP_BLOCK_198_51_100_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 198.51.100.1 at the edge interface GigabitEthernet0/2. Schedule auto-remove after investigation."}]}
{"instruction": "Mitigate repeated failed VPN negotiation attempts from 185.199.108.1", "config_raw": "crypto isakmp policy 10\n encr aes\n hash sha256\n authentication pre-share\n group 14\n!\n", "wazuh_alert": {"type": "vpn_bruteforce", "src_ip": "185.199.108.1", "severity": "high", "attempts": 200}, "gold_actions": [{"action_type": "mitigation", "commands": ["crypto isakmp policy 10", " set security-association lifetime seconds 3600", " isakmp deny 185.199.108.1"], "verify": ["show crypto isakmp sa"], "rollback": ["crypto isakmp policy 10", " no isakmp deny 185.199.108.1"], "explain": "Temporarily deny IKE negotiations from the offending IP and reduce SA lifetime. Validate with peers."}]}
{"instruction": "Block traffic from 185.199.108.1 at ingress on interface GigabitEthernet0/0", "config_raw": "interface GigabitEthernet0/0\n ip address 10.0.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "185.199.108.1", "dst_ip": "10.0.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_185_199_108_1", " deny ip host 185.199.108.1 any", " permit ip any any", "interface GigabitEthernet0/0", " ip access-group TEMP_BLOCK_185_199_108_1 in"], "verify": ["show access-lists TEMP_BLOCK_185_199_108_1", "show ip interface GigabitEthernet0/0"], "rollback": ["no ip access-list extended TEMP_BLOCK_185_199_108_1", "interface GigabitEthernet0/0", " no ip access-group TEMP_BLOCK_185_199_108_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 185.199.108.1 at the edge interface GigabitEthernet0/0. Schedule auto-remove after investigation."}]}
{"instruction": "Block traffic from 198.51.100.1 at ingress on interface GigabitEthernet0/0", "config_raw": "interface GigabitEthernet0/0\n ip address 172.16.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "198.51.100.1", "dst_ip": "192.168.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_198_51_100_1", " deny ip host 198.51.100.1 any", " permit ip any any", "interface GigabitEthernet0/0", " ip access-group TEMP_BLOCK_198_51_100_1 in"], "verify": ["show access-lists TEMP_BLOCK_198_51_100_1", "show ip interface GigabitEthernet0/0"], "rollback": ["no ip access-list extended TEMP_BLOCK_198_51_100_1", "interface GigabitEthernet0/0", " no ip access-group TEMP_BLOCK_198_51_100_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 198.51.100.1 at the edge interface GigabitEthernet0/0. Schedule auto-remove after investigation."}]}
{"instruction": "Block traffic from 198.51.100.1 at ingress on interface GigabitEthernet0/3", "config_raw": "interface GigabitEthernet0/3\n ip address 10.0.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "198.51.100.1", "dst_ip": "10.0.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_198_51_100_1", " deny ip host 198.51.100.1 any", " permit ip any any", "interface GigabitEthernet0/3", " ip access-group TEMP_BLOCK_198_51_100_1 in"], "verify": ["show access-lists TEMP_BLOCK_198_51_100_1", "show ip interface GigabitEthernet0/3"], "rollback": ["no ip access-list extended TEMP_BLOCK_198_51_100_1", "interface GigabitEthernet0/3", " no ip access-group TEMP_BLOCK_198_51_100_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 198.51.100.1 at the edge interface GigabitEthernet0/3. Schedule auto-remove after investigation."}]}
{"instruction": "Block traffic from 192.0.2.1 at ingress on interface GigabitEthernet0/0", "config_raw": "interface GigabitEthernet0/0\n ip address 172.16.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "192.0.2.1", "dst_ip": "10.0.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_192_0_2_1", " deny ip host 192.0.2.1 any", " permit ip any any", "interface GigabitEthernet0/0", " ip access-group TEMP_BLOCK_192_0_2_1 in"], "verify": ["show access-lists TEMP_BLOCK_192_0_2_1", "show ip interface GigabitEthernet0/0"], "rollback": ["no ip access-list extended TEMP_BLOCK_192_0_2_1", "interface GigabitEthernet0/0", " no ip access-group TEMP_BLOCK_192_0_2_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 192.0.2.1 at the edge interface GigabitEthernet0/0. Schedule auto-remove after investigation."}]}
{"instruction": "Prevent ARP spoofing on interface GigabitEthernet0/1", "config_raw": "interface GigabitEthernet0/1\n ip address 192.168.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "arp_spoofing", "src_ip": "10.0.0.1", "severity": "medium"}, "gold_actions": [{"action_type": "hardening", "commands": ["interface GigabitEthernet0/1", " ip arp inspection trust", " ip dhcp snooping trust"], "verify": ["show ip arp inspection interfaces"], "rollback": ["interface GigabitEthernet0/1", " no ip arp inspection trust"], "explain": "Enable DAI and DHCP snooping to reduce ARP spoofing risk. Requires global DHCP snooping/DAI config."}]}
{"instruction": "Mitigate ICMP/UDP flood from 185.199.108.1 towards interface GigabitEthernet0/3", "config_raw": "interface GigabitEthernet0/3\n ip address 192.168.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "icmp_flood", "src_ip": "185.199.108.1", "severity": "high", "pps": 30257}, "gold_actions": [{"action_type": "mitigation", "commands": ["control-plane", " service-policy input LIMIT_ICMP", "policy-map LIMIT_ICMP", " class class-default", "  police 8000 conform-action transmit exceed-action drop"], "verify": ["show policy-map interface control-plane"], "rollback": ["no policy-map LIMIT_ICMP"], "explain": "Rate-limits ICMP on the control plane to protect device CPU from flood. Verify in lab prior to production."}]}
{"instruction": "Block traffic from 198.51.100.1 at ingress on interface GigabitEthernet0/1", "config_raw": "interface GigabitEthernet0/1\n ip address 172.16.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "198.51.100.1", "dst_ip": "10.0.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_198_51_100_1", " deny ip host 198.51.100.1 any", " permit ip any any", "interface GigabitEthernet0/1", " ip access-group TEMP_BLOCK_198_51_100_1 in"], "verify": ["show access-lists TEMP_BLOCK_198_51_100_1", "show ip interface GigabitEthernet0/1"], "rollback": ["no ip access-list extended TEMP_BLOCK_198_51_100_1", "interface GigabitEthernet0/1", " no ip access-group TEMP_BLOCK_198_51_100_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 198.51.100.1 at the edge interface GigabitEthernet0/1. Schedule auto-remove after investigation."}]}
{"instruction": "Contain suspected data exfiltration from inside host 192.168.0.1 to external 192.0.2.1", "config_raw": "interface GigabitEthernet0/3\n ip address 172.16.0.1 255.255.255.0\n ip nat inside\n!\ninterface GigabitEthernet0/1\n ip address 198.51.100.1 255.255.255.0\n ip nat outside\n!\nip nat inside source static 192.168.0.1 192.0.2.1\n", "wazuh_alert": {"type": "data_exfiltration", "src_ip": "192.168.0.1", "dst_ip": "192.0.2.1", "severity": "critical", "evidence": ["large_transfer", "unusual_protocol"]}, "gold_actions": [{"action_type": "containment", "commands": ["ip access-list extended EXFIL_BLOCK", " deny ip host 192.168.0.1 any", " permit ip any any", "interface GigabitEthernet0/3", " ip access-group EXFIL_BLOCK in"], "verify": ["show access-lists EXFIL_BLOCK"], "rollback": ["no ip access-list extended EXFIL_BLOCK"], "explain": "Blocks outbound traffic temporarily from the compromised internal host to prevent further data exfiltration. Host may lose network access."}]}
{"instruction": "Mitigate ICMP/UDP flood from 203.0.113.1 towards interface GigabitEthernet0/3", "config_raw": "interface GigabitEthernet0/3\n ip address 10.0.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "icmp_flood", "src_ip": "203.0.113.1", "severity": "high", "pps": 71694}, "gold_actions": [{"action_type": "mitigation", "commands": ["control-plane", " service-policy input LIMIT_ICMP", "policy-map LIMIT_ICMP", " class class-default", "  police 8000 conform-action transmit exceed-action drop"], "verify": ["show policy-map interface control-plane"], "rollback": ["no policy-map LIMIT_ICMP"], "explain": "Rate-limits ICMP on the control plane to protect device CPU from flood. Verify in lab prior to production."}]}
{"instruction": "Harden weak console password and enable password encryption", "config_raw": "line con 0\n password cisco\n login\n!\n", "wazuh_alert": {"type": "weak_password_detected", "severity": "high", "evidence": ["default-password"]}, "gold_actions": [{"action_type": "hardening", "commands": ["line con 0", " password Stronger!Pass2025", " login local", " service password-encryption"], "verify": ["show running-config | section line con"], "rollback": ["line con 0", " password cisco"], "explain": "Replace default/weak console password with a stronger one, enable local login and encrypt stored passwords."}]}
{"instruction": "Protect OSPF domain from neighbor spoofing on GigabitEthernet0/3", "config_raw": "router ospf 45\n network 172.16.0.1 0.0.0.255 area 0\n!\ninterface GigabitEthernet0/3\n ip address 10.0.0.1 255.255.255.0\n!", "wazuh_alert": {"type": "ospf_neighbor_spoofing", "src_ip": "10.0.0.1", "dst_ip": "10.0.0.1", "severity": "high"}, "gold_actions": [{"action_type": "protection", "commands": ["router ospf 1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 StrongKey123"], "verify": ["show ip ospf neighbor", "show ip ospf interface"], "rollback": ["router ospf 1", " no ip ospf authentication message-digest"], "explain": "Enable MD5 authentication for OSPF to prevent bogus neighbor formation. Ensure matching keys on all peers."}]}
{"instruction": "Respond to suspected BGP route injection originating via peer 198.51.100.1", "config_raw": "router bgp 64563\n neighbor 198.51.100.1 remote-as 64848\n!\n", "wazuh_alert": {"type": "bgp_route_injection", "src_ip": "198.51.100.1", "severity": "critical", "evidence": ["unexpected-prefixes"]}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip prefix-list BLOCK_UNEXPECTED seq 5 deny 0.0.0.0/0 le 32", "router bgp 64512", " neighbor 198.51.100.1 route-map FILTER_IN in"], "verify": ["show ip bgp neighbors", "show ip route"], "rollback": ["no ip prefix-list BLOCK_UNEXPECTED", "router bgp 64512", " no neighbor 198.51.100.1 route-map FILTER_IN in"], "explain": "Apply inbound route filters to prevent acceptance of suspicious prefixes from the peer. Requires careful prefix-list tailoring."}]}
{"instruction": "Protect OSPF domain from neighbor spoofing on GigabitEthernet0/0", "config_raw": "router ospf 99\n network 172.16.0.1 0.0.0.255 area 0\n!\ninterface GigabitEthernet0/0\n ip address 172.16.0.1 255.255.255.0\n!", "wazuh_alert": {"type": "ospf_neighbor_spoofing", "src_ip": "192.168.0.1", "dst_ip": "192.168.0.1", "severity": "high"}, "gold_actions": [{"action_type": "protection", "commands": ["router ospf 1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 StrongKey123"], "verify": ["show ip ospf neighbor", "show ip ospf interface"], "rollback": ["router ospf 1", " no ip ospf authentication message-digest"], "explain": "Enable MD5 authentication for OSPF to prevent bogus neighbor formation. Ensure matching keys on all peers."}]}
{"instruction": "Protect OSPF domain from neighbor spoofing on GigabitEthernet0/2", "config_raw": "router ospf 4\n network 10.0.0.1 0.0.0.255 area 0\n!\ninterface GigabitEthernet0/2\n ip address 172.16.0.1 255.255.255.0\n!", "wazuh_alert": {"type": "ospf_neighbor_spoofing", "src_ip": "10.0.0.1", "dst_ip": "192.168.0.1", "severity": "high"}, "gold_actions": [{"action_type": "protection", "commands": ["router ospf 1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 StrongKey123"], "verify": ["show ip ospf neighbor", "show ip ospf interface"], "rollback": ["router ospf 1", " no ip ospf authentication message-digest"], "explain": "Enable MD5 authentication for OSPF to prevent bogus neighbor formation. Ensure matching keys on all peers."}]}
{"instruction": "Mitigate ICMP/UDP flood from 203.0.113.1 towards interface GigabitEthernet0/0", "config_raw": "interface GigabitEthernet0/0\n ip address 192.168.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "icmp_flood", "src_ip": "203.0.113.1", "severity": "high", "pps": 66959}, "gold_actions": [{"action_type": "mitigation", "commands": ["control-plane", " service-policy input LIMIT_ICMP", "policy-map LIMIT_ICMP", " class class-default", "  police 8000 conform-action transmit exceed-action drop"], "verify": ["show policy-map interface control-plane"], "rollback": ["no policy-map LIMIT_ICMP"], "explain": "Rate-limits ICMP on the control plane to protect device CPU from flood. Verify in lab prior to production."}]}
{"instruction": "Block traffic from 192.0.2.1 at ingress on interface GigabitEthernet0/3", "config_raw": "interface GigabitEthernet0/3\n ip address 192.168.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "192.0.2.1", "dst_ip": "192.168.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_192_0_2_1", " deny ip host 192.0.2.1 any", " permit ip any any", "interface GigabitEthernet0/3", " ip access-group TEMP_BLOCK_192_0_2_1 in"], "verify": ["show access-lists TEMP_BLOCK_192_0_2_1", "show ip interface GigabitEthernet0/3"], "rollback": ["no ip access-list extended TEMP_BLOCK_192_0_2_1", "interface GigabitEthernet0/3", " no ip access-group TEMP_BLOCK_192_0_2_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 192.0.2.1 at the edge interface GigabitEthernet0/3. Schedule auto-remove after investigation."}]}
{"instruction": "Prevent ARP spoofing on interface GigabitEthernet0/3", "config_raw": "interface GigabitEthernet0/3\n ip address 192.168.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "arp_spoofing", "src_ip": "10.0.0.1", "severity": "medium"}, "gold_actions": [{"action_type": "hardening", "commands": ["interface GigabitEthernet0/3", " ip arp inspection trust", " ip dhcp snooping trust"], "verify": ["show ip arp inspection interfaces"], "rollback": ["interface GigabitEthernet0/3", " no ip arp inspection trust"], "explain": "Enable DAI and DHCP snooping to reduce ARP spoofing risk. Requires global DHCP snooping/DAI config."}]}
{"instruction": "Mitigate repeated failed VPN negotiation attempts from 203.0.113.1", "config_raw": "crypto isakmp policy 10\n encr aes\n hash sha256\n authentication pre-share\n group 14\n!\n", "wazuh_alert": {"type": "vpn_bruteforce", "src_ip": "203.0.113.1", "severity": "high", "attempts": 131}, "gold_actions": [{"action_type": "mitigation", "commands": ["crypto isakmp policy 10", " set security-association lifetime seconds 3600", " isakmp deny 203.0.113.1"], "verify": ["show crypto isakmp sa"], "rollback": ["crypto isakmp policy 10", " no isakmp deny 203.0.113.1"], "explain": "Temporarily deny IKE negotiations from the offending IP and reduce SA lifetime. Validate with peers."}]}
{"instruction": "Protect OSPF domain from neighbor spoofing on GigabitEthernet0/1", "config_raw": "router ospf 47\n network 172.16.0.1 0.0.0.255 area 0\n!\ninterface GigabitEthernet0/1\n ip address 10.0.0.1 255.255.255.0\n!", "wazuh_alert": {"type": "ospf_neighbor_spoofing", "src_ip": "192.168.0.1", "dst_ip": "172.16.0.1", "severity": "high"}, "gold_actions": [{"action_type": "protection", "commands": ["router ospf 1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 StrongKey123"], "verify": ["show ip ospf neighbor", "show ip ospf interface"], "rollback": ["router ospf 1", " no ip ospf authentication message-digest"], "explain": "Enable MD5 authentication for OSPF to prevent bogus neighbor formation. Ensure matching keys on all peers."}]}
{"instruction": "Prevent ARP spoofing on interface GigabitEthernet0/2", "config_raw": "interface GigabitEthernet0/2\n ip address 192.168.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "arp_spoofing", "src_ip": "10.0.0.1", "severity": "medium"}, "gold_actions": [{"action_type": "hardening", "commands": ["interface GigabitEthernet0/2", " ip arp inspection trust", " ip dhcp snooping trust"], "verify": ["show ip arp inspection interfaces"], "rollback": ["interface GigabitEthernet0/2", " no ip arp inspection trust"], "explain": "Enable DAI and DHCP snooping to reduce ARP spoofing risk. Requires global DHCP snooping/DAI config."}]}
{"instruction": "Block traffic from 192.0.2.1 at ingress on interface GigabitEthernet0/2", "config_raw": "interface GigabitEthernet0/2\n ip address 192.168.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "192.0.2.1", "dst_ip": "172.16.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_192_0_2_1", " deny ip host 192.0.2.1 any", " permit ip any any", "interface GigabitEthernet0/2", " ip access-group TEMP_BLOCK_192_0_2_1 in"], "verify": ["show access-lists TEMP_BLOCK_192_0_2_1", "show ip interface GigabitEthernet0/2"], "rollback": ["no ip access-list extended TEMP_BLOCK_192_0_2_1", "interface GigabitEthernet0/2", " no ip access-group TEMP_BLOCK_192_0_2_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 192.0.2.1 at the edge interface GigabitEthernet0/2. Schedule auto-remove after investigation."}]}
{"instruction": "Mitigate SSH brute force from 45.33.32.1 and restrict VTY access to trusted networks", "config_raw": "ip ssh version 2\nline vty 0 4\n transport input ssh\n login local\n!\n", "wazuh_alert": {"type": "ssh_bruteforce", "src_ip": "45.33.32.1", "dst_ip": "192.168.0.1", "severity": "critical", "attempts": 125}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list standard SSH_ADMIN", " deny 45.33.32.1", " permit 192.168.0.0 0.0.255.255", "line vty 0 4", " access-class SSH_ADMIN in"], "verify": ["show access-lists SSH_ADMIN", "show line vty 0"], "rollback": ["no ip access-list standard SSH_ADMIN"], "explain": "Blocks attacker IP from accessing VTY and limits SSH access to known management networks. Verify that legitimate admins are within allowed range."}]}
{"instruction": "Block traffic from 198.51.100.1 at ingress on interface GigabitEthernet0/1", "config_raw": "interface GigabitEthernet0/1\n ip address 172.16.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "198.51.100.1", "dst_ip": "192.168.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_198_51_100_1", " deny ip host 198.51.100.1 any", " permit ip any any", "interface GigabitEthernet0/1", " ip access-group TEMP_BLOCK_198_51_100_1 in"], "verify": ["show access-lists TEMP_BLOCK_198_51_100_1", "show ip interface GigabitEthernet0/1"], "rollback": ["no ip access-list extended TEMP_BLOCK_198_51_100_1", "interface GigabitEthernet0/1", " no ip access-group TEMP_BLOCK_198_51_100_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 198.51.100.1 at the edge interface GigabitEthernet0/1. Schedule auto-remove after investigation."}]}
{"instruction": "Block traffic from 198.51.100.1 at ingress on interface GigabitEthernet0/2", "config_raw": "interface GigabitEthernet0/2\n ip address 172.16.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "198.51.100.1", "dst_ip": "192.168.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_198_51_100_1", " deny ip host 198.51.100.1 any", " permit ip any any", "interface GigabitEthernet0/2", " ip access-group TEMP_BLOCK_198_51_100_1 in"], "verify": ["show access-lists TEMP_BLOCK_198_51_100_1", "show ip interface GigabitEthernet0/2"], "rollback": ["no ip access-list extended TEMP_BLOCK_198_51_100_1", "interface GigabitEthernet0/2", " no ip access-group TEMP_BLOCK_198_51_100_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 198.51.100.1 at the edge interface GigabitEthernet0/2. Schedule auto-remove after investigation."}]}
{"instruction": "Protect OSPF domain from neighbor spoofing on GigabitEthernet0/2", "config_raw": "router ospf 37\n network 10.0.0.1 0.0.0.255 area 0\n!\ninterface GigabitEthernet0/2\n ip address 172.16.0.1 255.255.255.0\n!", "wazuh_alert": {"type": "ospf_neighbor_spoofing", "src_ip": "192.168.0.1", "dst_ip": "192.168.0.1", "severity": "high"}, "gold_actions": [{"action_type": "protection", "commands": ["router ospf 1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 StrongKey123"], "verify": ["show ip ospf neighbor", "show ip ospf interface"], "rollback": ["router ospf 1", " no ip ospf authentication message-digest"], "explain": "Enable MD5 authentication for OSPF to prevent bogus neighbor formation. Ensure matching keys on all peers."}]}
{"instruction": "Harden weak console password and enable password encryption", "config_raw": "line con 0\n password cisco\n login\n!\n", "wazuh_alert": {"type": "weak_password_detected", "severity": "high", "evidence": ["default-password"]}, "gold_actions": [{"action_type": "hardening", "commands": ["line con 0", " password Stronger!Pass2025", " login local", " service password-encryption"], "verify": ["show running-config | section line con"], "rollback": ["line con 0", " password cisco"], "explain": "Replace default/weak console password with a stronger one, enable local login and encrypt stored passwords."}]}
{"instruction": "Mitigate SSH brute force from 45.33.32.1 and restrict VTY access to trusted networks", "config_raw": "ip ssh version 2\nline vty 0 4\n transport input ssh\n login local\n!\n", "wazuh_alert": {"type": "ssh_bruteforce", "src_ip": "45.33.32.1", "dst_ip": "172.16.0.1", "severity": "critical", "attempts": 163}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list standard SSH_ADMIN", " deny 45.33.32.1", " permit 192.168.0.0 0.0.255.255", "line vty 0 4", " access-class SSH_ADMIN in"], "verify": ["show access-lists SSH_ADMIN", "show line vty 0"], "rollback": ["no ip access-list standard SSH_ADMIN"], "explain": "Blocks attacker IP from accessing VTY and limits SSH access to known management networks. Verify that legitimate admins are within allowed range."}]}
{"instruction": "Mitigate repeated failed VPN negotiation attempts from 198.51.100.1", "config_raw": "crypto isakmp policy 10\n encr aes\n hash sha256\n authentication pre-share\n group 14\n!\n", "wazuh_alert": {"type": "vpn_bruteforce", "src_ip": "198.51.100.1", "severity": "high", "attempts": 150}, "gold_actions": [{"action_type": "mitigation", "commands": ["crypto isakmp policy 10", " set security-association lifetime seconds 3600", " isakmp deny 198.51.100.1"], "verify": ["show crypto isakmp sa"], "rollback": ["crypto isakmp policy 10", " no isakmp deny 198.51.100.1"], "explain": "Temporarily deny IKE negotiations from the offending IP and reduce SA lifetime. Validate with peers."}]}
{"instruction": "Mitigate SSH brute force from 198.51.100.1 and restrict VTY access to trusted networks", "config_raw": "ip ssh version 2\nline vty 0 4\n transport input ssh\n login local\n!\n", "wazuh_alert": {"type": "ssh_bruteforce", "src_ip": "198.51.100.1", "dst_ip": "192.168.0.1", "severity": "critical", "attempts": 71}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list standard SSH_ADMIN", " deny 198.51.100.1", " permit 192.168.0.0 0.0.255.255", "line vty 0 4", " access-class SSH_ADMIN in"], "verify": ["show access-lists SSH_ADMIN", "show line vty 0"], "rollback": ["no ip access-list standard SSH_ADMIN"], "explain": "Blocks attacker IP from accessing VTY and limits SSH access to known management networks. Verify that legitimate admins are within allowed range."}]}
{"instruction": "Respond to suspected BGP route injection originating via peer 185.199.108.1", "config_raw": "router bgp 64596\n neighbor 185.199.108.1 remote-as 65160\n!\n", "wazuh_alert": {"type": "bgp_route_injection", "src_ip": "185.199.108.1", "severity": "critical", "evidence": ["unexpected-prefixes"]}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip prefix-list BLOCK_UNEXPECTED seq 5 deny 0.0.0.0/0 le 32", "router bgp 64512", " neighbor 185.199.108.1 route-map FILTER_IN in"], "verify": ["show ip bgp neighbors", "show ip route"], "rollback": ["no ip prefix-list BLOCK_UNEXPECTED", "router bgp 64512", " no neighbor 185.199.108.1 route-map FILTER_IN in"], "explain": "Apply inbound route filters to prevent acceptance of suspicious prefixes from the peer. Requires careful prefix-list tailoring."}]}
{"instruction": "Prevent ARP spoofing on interface GigabitEthernet0/2", "config_raw": "interface GigabitEthernet0/2\n ip address 10.0.0.1 255.255.255.0\n!\n", "wazuh_alert": {"type": "arp_spoofing", "src_ip": "10.0.0.1", "severity": "medium"}, "gold_actions": [{"action_type": "hardening", "commands": ["interface GigabitEthernet0/2", " ip arp inspection trust", " ip dhcp snooping trust"], "verify": ["show ip arp inspection interfaces"], "rollback": ["interface GigabitEthernet0/2", " no ip arp inspection trust"], "explain": "Enable DAI and DHCP snooping to reduce ARP spoofing risk. Requires global DHCP snooping/DAI config."}]}
{"instruction": "Mitigate repeated failed VPN negotiation attempts from 192.0.2.1", "config_raw": "crypto isakmp policy 10\n encr aes\n hash sha256\n authentication pre-share\n group 14\n!\n", "wazuh_alert": {"type": "vpn_bruteforce", "src_ip": "192.0.2.1", "severity": "high", "attempts": 77}, "gold_actions": [{"action_type": "mitigation", "commands": ["crypto isakmp policy 10", " set security-association lifetime seconds 3600", " isakmp deny 192.0.2.1"], "verify": ["show crypto isakmp sa"], "rollback": ["crypto isakmp policy 10", " no isakmp deny 192.0.2.1"], "explain": "Temporarily deny IKE negotiations from the offending IP and reduce SA lifetime. Validate with peers."}]}
{"instruction": "Protect OSPF domain from neighbor spoofing on GigabitEthernet0/1", "config_raw": "router ospf 4\n network 10.0.0.1 0.0.0.255 area 0\n!\ninterface GigabitEthernet0/1\n ip address 10.0.0.1 255.255.255.0\n!", "wazuh_alert": {"type": "ospf_neighbor_spoofing", "src_ip": "172.16.0.1", "dst_ip": "192.168.0.1", "severity": "high"}, "gold_actions": [{"action_type": "protection", "commands": ["router ospf 1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 StrongKey123"], "verify": ["show ip ospf neighbor", "show ip ospf interface"], "rollback": ["router ospf 1", " no ip ospf authentication message-digest"], "explain": "Enable MD5 authentication for OSPF to prevent bogus neighbor formation. Ensure matching keys on all peers."}]}
{"instruction": "Block traffic from 203.0.113.1 at ingress on interface GigabitEthernet0/3", "config_raw": "interface GigabitEthernet0/3\n ip address 172.16.0.1 255.255.255.0\n ip access-group INBOUND_POLICY in\n!\nip access-list extended INBOUND_POLICY\n permit ip any any\n!\n", "wazuh_alert": {"type": "port_scan", "src_ip": "203.0.113.1", "dst_ip": "192.168.0.1", "protocol": "TCP", "severity": "high"}, "gold_actions": [{"action_type": "mitigation", "commands": ["ip access-list extended TEMP_BLOCK_203_0_113_1", " deny ip host 203.0.113.1 any", " permit ip any any", "interface GigabitEthernet0/3", " ip access-group TEMP_BLOCK_203_0_113_1 in"], "verify": ["show access-lists TEMP_BLOCK_203_0_113_1", "show ip interface GigabitEthernet0/3"], "rollback": ["no ip access-list extended TEMP_BLOCK_203_0_113_1", "interface GigabitEthernet0/3", " no ip access-group TEMP_BLOCK_203_0_113_1 in"], "explain": "Temporary ACL blocks suspicious scanning source 203.0.113.1 at the edge interface GigabitEthernet0/3. Schedule auto-remove after investigation."}]}
{"instruction": "Increase logging and forward suspicious events to SIEM", "config_raw": "logging host 45.33.32.1\nlogging trap informational\n!\n", "wazuh_alert": {"type": "suspicious_activity_high_volume", "src_ip": "198.51.100.1", "severity": "medium"}, "gold_actions": [{"action_type": "monitoring", "commands": ["logging host 45.33.32.1", "logging trap warning", "service timestamps log datetime msec"], "verify": ["show logging"], "rollback": [], "explain": "Increase logging verbosity and forward logs to SIEM for detailed analysis."}]}