{"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.4.178) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.178\nAdvertising Router: 10.0.4.178\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or unstable adjacency.", "local_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"], "neighbor_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.217 1 EXSTART/DR 00:00:33 10.0.3.220 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.236 1 2-WAY/DROTHER 00:00:33 10.0.5.215 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.157 1 EXCHANGE/DR 00:00:33 10.0.1.69 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.3.194) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.194\nAdvertising Router: 10.0.3.194\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.58 1 2-WAY/DROTHER 00:00:33 10.0.3.69 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.166 1 2-WAY/DROTHER 00:00:33 10.0.3.242 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.67 1 EXCHANGE/DR 00:00:33 10.0.2.82 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.4.146) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.146\nAdvertising Router: 10.0.4.146\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.0.63) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.63\nAdvertising Router: 10.0.0.63\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or unstable adjacency.", "local_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"], "neighbor_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.198 1 LOADING/DR 00:00:33 10.0.4.184 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.5.98 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.194 1 DOWN 00:00:00 10.0.2.53 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.138 1 DOWN 00:00:33 10.0.1.74 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.31 1 EXCHANGE/DR 00:00:33 10.0.4.55 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.4.89) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.89\nAdvertising Router: 10.0.4.89\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.218 1 INIT/DROTHER 00:00:33 10.0.1.69 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.107 1 EXCHANGE/DR 00:00:33 10.0.5.231 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.1.198) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.198\nAdvertising Router: 10.0.1.198\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.142 1 INIT/DROTHER 00:00:33 10.0.3.100 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.29 1 DOWN 00:00:33 10.0.5.97 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.147 1 INIT/DROTHER 00:00:33 10.0.2.196 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.113 1 DOWN 00:00:00 10.0.3.75 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.25 1 LOADING/DR 00:00:33 10.0.5.25 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.1.43 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.164 1 DOWN 00:00:33 10.0.2.194 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.216 1 EXSTART/DR 00:00:33 10.0.5.25 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.95 1 DOWN 00:00:00 10.0.3.70 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.119 1 EXSTART/DR 00:00:33 10.0.3.12 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.37 1 EXSTART/DR 00:00:33 10.0.1.205 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.69 1 EXSTART/DR 00:00:33 10.0.5.179 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.33 1 INIT/DROTHER 00:00:33 10.0.5.171 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.126 1 DOWN 00:00:00 10.0.4.172 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.0.249) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.249\nAdvertising Router: 10.0.0.249\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or unstable adjacency.", "local_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"], "neighbor_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.45 1 DOWN 00:00:33 10.0.5.236 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.33 1 EXSTART/DR 00:00:33 10.0.1.179 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.254 1 2-WAY/DROTHER 00:00:33 10.0.5.179 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.103 1 LOADING/DR 00:00:33 10.0.2.190 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.4.232 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.90 1 INIT/DROTHER 00:00:33 10.0.1.251 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.236 1 INIT/DROTHER 00:00:33 10.0.5.25 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.64 1 DOWN 00:00:33 10.0.1.62 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.5 1 INIT/DROTHER 00:00:33 10.0.5.90 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.245 1 DOWN 00:00:33 10.0.5.127 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.175 1 EXCHANGE/DR 00:00:33 10.0.1.140 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.5.16) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.5.16\nAdvertising Router: 10.0.5.16\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.112 1 INIT/DROTHER 00:00:33 10.0.2.209 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.184 1 LOADING/DR 00:00:33 10.0.4.254 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.1.77 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.5 1 EXCHANGE/DR 00:00:33 10.0.3.250 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.4.93) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.93\nAdvertising Router: 10.0.4.93\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.67 1 LOADING/DR 00:00:33 10.0.1.105 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.5.62 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.95 1 INIT/DROTHER 00:00:33 10.0.3.208 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.61 1 LOADING/DR 00:00:33 10.0.3.133 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.0.46 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.212 1 DOWN 00:00:00 10.0.1.85 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.187 1 EXCHANGE/DR 00:00:33 10.0.5.185 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.1.69) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.69\nAdvertising Router: 10.0.1.69\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.153 1 INIT/DROTHER 00:00:33 10.0.1.141 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.223 1 DOWN 00:00:33 10.0.3.64 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync", "device": "CORE-R1"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.2.76) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.76\nAdvertising Router: 10.0.2.76\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or unstable adjacency.", "local_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"], "neighbor_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.163 1 INIT/DROTHER 00:00:33 10.0.5.63 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.3.22) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.22\nAdvertising Router: 10.0.3.22\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or unstable adjacency.", "local_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"], "neighbor_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.29 1 EXSTART/DR 00:00:33 10.0.3.133 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.61 1 DOWN 00:00:33 10.0.5.33 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.34 1 EXCHANGE/DR 00:00:33 10.0.4.215 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.3.120) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.120\nAdvertising Router: 10.0.3.120\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.38 1 DOWN 00:00:33 10.0.5.188 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.146 1 DOWN 00:00:00 10.0.5.164 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.168 1 INIT/DROTHER 00:00:33 10.0.5.187 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.209 1 LOADING/DR 00:00:33 10.0.3.138 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.5.12 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.124 1 DOWN 00:00:33 10.0.1.252 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.140 1 DOWN 00:00:00 10.0.4.194 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.118 1 DOWN 00:00:33 10.0.3.227 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.192 1 INIT/DROTHER 00:00:33 10.0.4.251 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.177 1 EXSTART/DR 00:00:33 10.0.2.81 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.212 1 DOWN 00:00:33 10.0.2.232 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.2.24) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.24\nAdvertising Router: 10.0.2.24\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or unstable adjacency.", "local_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"], "neighbor_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.217 1 EXCHANGE/DR 00:00:33 10.0.2.213 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.3.239) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.239\nAdvertising Router: 10.0.3.239\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.138 1 DOWN 00:00:00 10.0.4.128 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.80 1 INIT/DROTHER 00:00:33 10.0.3.236 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.82 1 LOADING/DR 00:00:33 10.0.2.177 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.1.201 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.223 1 DOWN 00:00:33 10.0.3.163 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.4 1 DOWN 00:00:33 10.0.2.26 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.166 1 LOADING/DR 00:00:33 10.0.2.249 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.1.234 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.81 1 DOWN 00:00:33 10.0.3.31 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.111 1 INIT/DROTHER 00:00:33 10.0.5.152 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.55 1 LOADING/DR 00:00:33 10.0.5.93 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.5.13 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.23 1 INIT/DROTHER 00:00:33 10.0.1.44 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.50 1 DOWN 00:00:33 10.0.5.82 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.65 1 EXCHANGE/DR 00:00:33 10.0.2.130 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.3.233) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.233\nAdvertising Router: 10.0.3.233\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.216 1 DOWN 00:00:33 10.0.1.145 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.88 1 EXSTART/DR 00:00:33 10.0.1.38 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.35 1 2-WAY/DROTHER 00:00:33 10.0.1.221 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.83 1 DOWN 00:00:00 10.0.1.147 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.161 1 EXSTART/DR 00:00:33 10.0.2.88 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.67 1 INIT/DROTHER 00:00:33 10.0.3.149 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.234 1 INIT/DROTHER 00:00:33 10.0.1.147 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.88 1 DOWN 00:00:33 10.0.1.230 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.4 1 LOADING/DR 00:00:33 10.0.1.155 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.4.231 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.19 1 EXSTART/DR 00:00:33 10.0.5.201 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.250 1 EXSTART/DR 00:00:33 10.0.2.97 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.189 1 INIT/DROTHER 00:00:33 10.0.5.216 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.63 1 EXSTART/DR 00:00:33 10.0.2.157 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.174 1 EXCHANGE/DR 00:00:33 10.0.5.153 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.3.172) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.172\nAdvertising Router: 10.0.3.172\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.250 1 EXSTART/DR 00:00:33 10.0.3.161 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.225 1 DOWN 00:00:33 10.0.1.242 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.89 1 DOWN 00:00:00 10.0.5.212 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.195 1 DOWN 00:00:33 10.0.2.51 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.108 1 DOWN 00:00:00 10.0.1.154 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.9 1 EXSTART/DR 00:00:33 10.0.5.185 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.218 1 DOWN 00:00:00 10.0.4.98 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.212 1 EXSTART/DR 00:00:33 10.0.3.226 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.29 1 2-WAY/DROTHER 00:00:33 10.0.1.100 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.112 1 EXSTART/DR 00:00:33 10.0.3.24 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.66 1 LOADING/DR 00:00:33 10.0.2.14 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.5.238 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.243 1 LOADING/DR 00:00:33 10.0.3.193 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.2.232 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.254 1 INIT/DROTHER 00:00:33 10.0.3.31 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.49 1 INIT/DROTHER 00:00:33 10.0.5.243 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.246 1 EXCHANGE/DR 00:00:33 10.0.3.164 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.0.117) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.117\nAdvertising Router: 10.0.0.117\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.62 1 EXSTART/DR 00:00:33 10.0.2.197 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.111 1 INIT/DROTHER 00:00:33 10.0.5.121 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.0.127) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.127\nAdvertising Router: 10.0.0.127\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or unstable adjacency.", "local_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"], "neighbor_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.178 1 LOADING/DR 00:00:33 10.0.2.224 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.5.246 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.97 1 EXCHANGE/DR 00:00:33 10.0.2.41 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.1.94) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.94\nAdvertising Router: 10.0.1.94\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.5.39) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.5.39\nAdvertising Router: 10.0.5.39\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or unstable adjacency.", "local_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"], "neighbor_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.2 1 DOWN 00:00:33 10.0.2.192 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.158 1 DOWN 00:00:33 10.0.3.247 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.168 1 LOADING/DR 00:00:33 10.0.5.44 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.3.191 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.236 1 INIT/DROTHER 00:00:33 10.0.2.180 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.60 1 2-WAY/DROTHER 00:00:33 10.0.1.2 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.214 1 LOADING/DR 00:00:33 10.0.3.117 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.3.24 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.124 1 INIT/DROTHER 00:00:33 10.0.4.9 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.19 1 LOADING/DR 00:00:33 10.0.2.254 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.3.156 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.109 1 EXCHANGE/DR 00:00:33 10.0.1.35 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.0.140) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.140\nAdvertising Router: 10.0.0.140\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.100 1 2-WAY/DROTHER 00:00:33 10.0.5.85 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.25 1 LOADING/DR 00:00:33 10.0.1.206 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.5.182 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.0.226) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.226\nAdvertising Router: 10.0.0.226\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or unstable adjacency.", "local_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"], "neighbor_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.148 1 DOWN 00:00:33 10.0.1.150 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.57 1 LOADING/DR 00:00:33 10.0.1.100 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.1.231 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.61 1 LOADING/DR 00:00:33 10.0.5.203 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.4.147 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.134 1 INIT/DROTHER 00:00:33 10.0.3.24 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.81 1 EXSTART/DR 00:00:33 10.0.3.231 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.253 1 INIT/DROTHER 00:00:33 10.0.5.114 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.141 1 EXCHANGE/DR 00:00:33 10.0.1.20 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.0.140) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.140\nAdvertising Router: 10.0.0.140\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.193 1 DOWN 00:00:33 10.0.5.118 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.243 1 LOADING/DR 00:00:33 10.0.3.254 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.0.16 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.163 1 EXSTART/DR 00:00:33 10.0.2.141 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.24 1 EXSTART/DR 00:00:33 10.0.2.201 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.86 1 EXSTART/DR 00:00:33 10.0.5.47 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.134 1 EXCHANGE/DR 00:00:33 10.0.2.49 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.3.101) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.101\nAdvertising Router: 10.0.3.101\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.45 1 DOWN 00:00:33 10.0.4.188 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.241 1 INIT/DROTHER 00:00:33 10.0.1.186 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.106 1 INIT/DROTHER 00:00:33 10.0.4.21 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.170 1 EXCHANGE/DR 00:00:33 10.0.2.233 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.5.95) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.5.95\nAdvertising Router: 10.0.5.95\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.222 1 2-WAY/DROTHER 00:00:33 10.0.4.123 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.108 1 EXSTART/DR 00:00:33 10.0.2.215 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.53 1 EXCHANGE/DR 00:00:33 10.0.3.185 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.5.30) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.5.30\nAdvertising Router: 10.0.5.30\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.74 1 2-WAY/DROTHER 00:00:33 10.0.4.63 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.115 1 DOWN 00:00:00 10.0.1.23 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.47 1 INIT/DROTHER 00:00:33 10.0.2.37 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.22 1 DOWN 00:00:00 10.0.1.195 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.39 1 DOWN 00:00:00 10.0.2.234 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.65 1 DOWN 00:00:33 10.0.1.3 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.12 1 INIT/DROTHER 00:00:33 10.0.3.249 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.220 1 DOWN 00:00:33 10.0.4.94 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.103 1 INIT/DROTHER 00:00:33 10.0.2.14 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.126 1 EXCHANGE/DR 00:00:33 10.0.3.113 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.0.156) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.156\nAdvertising Router: 10.0.0.156\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.31 1 2-WAY/DROTHER 00:00:33 10.0.5.208 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.78 1 DOWN 00:00:00 10.0.2.5 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.152 1 EXSTART/DR 00:00:33 10.0.4.214 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.35 1 DOWN 00:00:33 10.0.3.129 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.28 1 LOADING/DR 00:00:33 10.0.4.128 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.4.59 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.129 1 LOADING/DR 00:00:33 10.0.1.231 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.2.250 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.87 1 EXSTART/DR 00:00:33 10.0.1.161 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.116 1 EXSTART/DR 00:00:33 10.0.2.128 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.9 1 DOWN 00:00:00 10.0.4.71 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.209 1 EXSTART/DR 00:00:33 10.0.2.51 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.190 1 EXSTART/DR 00:00:33 10.0.4.100 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.153 1 EXCHANGE/DR 00:00:33 10.0.5.210 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.2.160) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.160\nAdvertising Router: 10.0.2.160\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.144 1 INIT/DROTHER 00:00:33 10.0.4.25 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.220 1 EXSTART/DR 00:00:33 10.0.1.56 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.4.23) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.23\nAdvertising Router: 10.0.4.23\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or unstable adjacency.", "local_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"], "neighbor_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.2 1 DOWN 00:00:00 10.0.2.244 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.159 1 EXCHANGE/DR 00:00:33 10.0.5.108 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.0.246) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.246\nAdvertising Router: 10.0.0.246\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.38 1 EXSTART/DR 00:00:33 10.0.3.253 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.155 1 DOWN 00:00:33 10.0.4.93 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.48 1 LOADING/DR 00:00:33 10.0.3.172 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.4.89 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.108 1 INIT/DROTHER 00:00:33 10.0.2.204 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.243 1 EXSTART/DR 00:00:33 10.0.2.77 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.159 1 LOADING/DR 00:00:33 10.0.1.23 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.0.71 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.136 1 EXSTART/DR 00:00:33 10.0.4.146 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.160 1 DOWN 00:00:00 10.0.4.176 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.64 1 EXCHANGE/DR 00:00:33 10.0.1.15 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.1.35) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.35\nAdvertising Router: 10.0.1.35\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.137 1 DOWN 00:00:00 10.0.1.40 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.14 1 INIT/DROTHER 00:00:33 10.0.2.26 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.195 1 DOWN 00:00:00 10.0.3.158 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.88 1 DOWN 00:00:00 10.0.5.118 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.252 1 LOADING/DR 00:00:33 10.0.5.239 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.2.209 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.111 1 EXSTART/DR 00:00:33 10.0.3.90 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.87 1 INIT/DROTHER 00:00:33 10.0.3.162 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.179 1 2-WAY/DROTHER 00:00:33 10.0.4.145 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.205 1 INIT/DROTHER 00:00:33 10.0.1.61 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.65 1 EXSTART/DR 00:00:33 10.0.2.136 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.41 1 INIT/DROTHER 00:00:33 10.0.5.249 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.2.118) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.118\nAdvertising Router: 10.0.2.118\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or unstable adjacency.", "local_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"], "neighbor_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.0.239) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.239\nAdvertising Router: 10.0.0.239\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or unstable adjacency.", "local_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"], "neighbor_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.242 1 INIT/DROTHER 00:00:33 10.0.4.186 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.11 1 INIT/DROTHER 00:00:33 10.0.5.127 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.19 1 INIT/DROTHER 00:00:33 10.0.4.190 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.51 1 EXSTART/DR 00:00:33 10.0.5.212 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.3.219) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.219\nAdvertising Router: 10.0.3.219\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or unstable adjacency.", "local_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"], "neighbor_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.57 1 DOWN 00:00:00 10.0.1.52 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.6 1 EXSTART/DR 00:00:33 10.0.4.124 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.114 1 EXCHANGE/DR 00:00:33 10.0.4.126 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.4.1) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.1\nAdvertising Router: 10.0.4.1\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.215 1 EXSTART/DR 00:00:33 10.0.1.130 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.138 1 DOWN 00:00:00 10.0.3.234 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.77 1 INIT/DROTHER 00:00:33 10.0.4.199 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.250 1 INIT/DROTHER 00:00:33 10.0.3.175 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.57 1 2-WAY/DROTHER 00:00:33 10.0.4.52 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.150 1 EXCHANGE/DR 00:00:33 10.0.2.68 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.2.73) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.73\nAdvertising Router: 10.0.2.73\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.174 1 EXSTART/DR 00:00:33 10.0.2.77 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.175 1 DOWN 00:00:33 10.0.4.70 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.52 1 DOWN 00:00:00 10.0.5.195 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.4.69) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.69\nAdvertising Router: 10.0.4.69\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or unstable adjacency.", "local_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"], "neighbor_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.206 1 DOWN 00:00:00 10.0.4.132 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.166 1 EXSTART/DR 00:00:33 10.0.4.2 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.74 1 DOWN 00:00:33 10.0.2.201 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.221 1 EXSTART/DR 00:00:33 10.0.3.197 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.27 1 EXSTART/DR 00:00:33 10.0.3.21 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.232 1 INIT/DROTHER 00:00:33 10.0.3.46 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.103 1 INIT/DROTHER 00:00:33 10.0.1.19 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.57 1 INIT/DROTHER 00:00:33 10.0.4.96 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.93 1 LOADING/DR 00:00:33 10.0.5.31 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.1.250 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.41 1 INIT/DROTHER 00:00:33 10.0.3.6 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.186 1 2-WAY/DROTHER 00:00:33 10.0.3.223 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.33 1 EXSTART/DR 00:00:33 10.0.1.254 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.177 1 EXSTART/DR 00:00:33 10.0.3.117 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.36 1 DOWN 00:00:33 10.0.5.18 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.167 1 EXSTART/DR 00:00:33 10.0.4.204 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.142 1 EXSTART/DR 00:00:33 10.0.5.3 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.152 1 INIT/DROTHER 00:00:33 10.0.3.158 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.75 1 EXSTART/DR 00:00:33 10.0.3.20 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.149 1 DOWN 00:00:33 10.0.1.92 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.166 1 LOADING/DR 00:00:33 10.0.1.231 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.1.158 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.158 1 EXSTART/DR 00:00:33 10.0.2.13 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.113 1 EXCHANGE/DR 00:00:33 10.0.3.172 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.1.7) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.7\nAdvertising Router: 10.0.1.7\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.205 1 INIT/DROTHER 00:00:33 10.0.4.250 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.84 1 INIT/DROTHER 00:00:33 10.0.4.174 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.152 1 EXCHANGE/DR 00:00:33 10.0.2.40 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.1.170) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.170\nAdvertising Router: 10.0.1.170\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.211 1 LOADING/DR 00:00:33 10.0.3.196 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.5.25 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.107 1 INIT/DROTHER 00:00:33 10.0.5.190 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.9 1 EXSTART/DR 00:00:33 10.0.1.49 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.208 1 DOWN 00:00:33 10.0.4.140 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.47 1 INIT/DROTHER 00:00:33 10.0.4.109 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.236 1 2-WAY/DROTHER 00:00:33 10.0.2.103 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.4.176) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.176\nAdvertising Router: 10.0.4.176\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or unstable adjacency.", "local_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"], "neighbor_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.213 1 2-WAY/DROTHER 00:00:33 10.0.2.164 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.15 1 LOADING/DR 00:00:33 10.0.4.128 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.5.124 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.234 1 EXCHANGE/DR 00:00:33 10.0.3.85 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.2.53) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.53\nAdvertising Router: 10.0.2.53\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.238 1 EXSTART/DR 00:00:33 10.0.2.70 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.146 1 2-WAY/DROTHER 00:00:33 10.0.1.88 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.188 1 INIT/DROTHER 00:00:33 10.0.4.185 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.241 1 INIT/DROTHER 00:00:33 10.0.4.132 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.12 1 EXSTART/DR 00:00:33 10.0.5.211 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.41 1 LOADING/DR 00:00:33 10.0.1.219 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.0.126 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.242 1 EXSTART/DR 00:00:33 10.0.2.197 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.77 1 EXSTART/DR 00:00:33 10.0.1.127 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.193 1 LOADING/DR 00:00:33 10.0.4.111 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.4.241 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.3 1 LOADING/DR 00:00:33 10.0.2.39 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.4.200 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.44 1 EXSTART/DR 00:00:33 10.0.4.46 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.202 1 EXSTART/DR 00:00:33 10.0.2.3 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.137 1 DOWN 00:00:00 10.0.4.162 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.240 1 EXCHANGE/DR 00:00:33 10.0.4.50 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.5.223) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.5.223\nAdvertising Router: 10.0.5.223\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.232 1 EXCHANGE/DR 00:00:33 10.0.3.212 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.5.100) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.5.100\nAdvertising Router: 10.0.5.100\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.1 1 2-WAY/DROTHER 00:00:33 10.0.2.228 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.29 1 EXSTART/DR 00:00:33 10.0.4.121 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.173 1 EXSTART/DR 00:00:33 10.0.5.54 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.75 1 INIT/DROTHER 00:00:33 10.0.2.88 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.50 1 EXSTART/DR 00:00:33 10.0.2.44 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.2.66) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.66\nAdvertising Router: 10.0.2.66\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or unstable adjacency.", "local_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"], "neighbor_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.161 1 EXSTART/DR 00:00:33 10.0.2.26 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.29 1 EXSTART/DR 00:00:33 10.0.2.211 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.98 1 DOWN 00:00:00 10.0.3.214 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.229 1 2-WAY/DROTHER 00:00:33 10.0.2.63 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.17 1 EXSTART/DR 00:00:33 10.0.2.2 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.85 1 DOWN 00:00:00 10.0.2.110 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.45 1 LOADING/DR 00:00:33 10.0.2.35 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.2.30 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.45 1 INIT/DROTHER 00:00:33 10.0.2.11 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.209 1 DOWN 00:00:33 10.0.2.55 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.244 1 DOWN 00:00:00 10.0.4.234 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.206 1 EXCHANGE/DR 00:00:33 10.0.4.37 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.2.153) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.153\nAdvertising Router: 10.0.2.153\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.94 1 EXCHANGE/DR 00:00:33 10.0.1.76 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.5.98) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.5.98\nAdvertising Router: 10.0.5.98\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.224 1 LOADING/DR 00:00:33 10.0.2.195 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.4.101 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.134 1 INIT/DROTHER 00:00:33 10.0.1.40 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.28 1 INIT/DROTHER 00:00:33 10.0.4.119 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.4.159) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.159\nAdvertising Router: 10.0.4.159\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or unstable adjacency.", "local_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"], "neighbor_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.252 1 EXSTART/DR 00:00:33 10.0.4.90 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.223 1 LOADING/DR 00:00:33 10.0.2.155 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.1.200 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.135 1 DOWN 00:00:33 10.0.4.204 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.30 1 LOADING/DR 00:00:33 10.0.2.205 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.5.79 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.60 1 EXSTART/DR 00:00:33 10.0.4.239 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.112 1 EXCHANGE/DR 00:00:33 10.0.3.111 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.2.157) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.157\nAdvertising Router: 10.0.2.157\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.157 1 EXCHANGE/DR 00:00:33 10.0.2.168 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.2.146) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.146\nAdvertising Router: 10.0.2.146\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.114 1 2-WAY/DROTHER 00:00:33 10.0.2.240 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.21 1 DOWN 00:00:00 10.0.3.27 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.179 1 EXSTART/DR 00:00:33 10.0.4.58 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.179 1 EXSTART/DR 00:00:33 10.0.5.212 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.170 1 LOADING/DR 00:00:33 10.0.3.118 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.5.141 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.235 1 INIT/DROTHER 00:00:33 10.0.2.10 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.212 1 EXSTART/DR 00:00:33 10.0.3.216 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.52 1 2-WAY/DROTHER 00:00:33 10.0.5.116 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.229 1 INIT/DROTHER 00:00:33 10.0.2.23 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.159 1 LOADING/DR 00:00:33 10.0.5.237 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.2.163 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.146 1 INIT/DROTHER 00:00:33 10.0.3.23 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.41 1 EXSTART/DR 00:00:33 10.0.3.250 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.5.55) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.5.55\nAdvertising Router: 10.0.5.55\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or unstable adjacency.", "local_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"], "neighbor_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.60 1 INIT/DROTHER 00:00:33 10.0.2.189 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.203 1 EXSTART/DR 00:00:33 10.0.2.203 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.87 1 LOADING/DR 00:00:33 10.0.3.19 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.5.72 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.123 1 2-WAY/DROTHER 00:00:33 10.0.4.30 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.204 1 2-WAY/DROTHER 00:00:33 10.0.2.238 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.17 1 EXCHANGE/DR 00:00:33 10.0.5.98 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.2.224) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.224\nAdvertising Router: 10.0.2.224\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.76 1 2-WAY/DROTHER 00:00:33 10.0.5.235 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.217 1 EXSTART/DR 00:00:33 10.0.3.30 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.44 1 EXSTART/DR 00:00:33 10.0.2.132 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.159 1 EXSTART/DR 00:00:33 10.0.5.73 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.247 1 INIT/DROTHER 00:00:33 10.0.5.168 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.87 1 INIT/DROTHER 00:00:33 10.0.1.157 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.148 1 EXCHANGE/DR 00:00:33 10.0.4.72 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.2.105) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.105\nAdvertising Router: 10.0.2.105\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.59 1 2-WAY/DROTHER 00:00:33 10.0.1.56 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.10 1 2-WAY/DROTHER 00:00:33 10.0.4.160 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.165 1 INIT/DROTHER 00:00:33 10.0.1.80 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.138 1 EXSTART/DR 00:00:33 10.0.3.34 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.1.102) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.102\nAdvertising Router: 10.0.1.102\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or unstable adjacency.", "local_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"], "neighbor_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.3.210) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.210\nAdvertising Router: 10.0.3.210\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or unstable adjacency.", "local_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"], "neighbor_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.200 1 DOWN 00:00:33 10.0.2.122 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.118 1 INIT/DROTHER 00:00:33 10.0.1.173 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.61 1 EXSTART/DR 00:00:33 10.0.1.138 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.41 1 EXSTART/DR 00:00:33 10.0.4.119 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.46 1 INIT/DROTHER 00:00:33 10.0.3.33 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.38 1 LOADING/DR 00:00:33 10.0.1.219 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.4.124 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.112 1 EXSTART/DR 00:00:33 10.0.5.135 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.13 1 INIT/DROTHER 00:00:33 10.0.3.62 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.82 1 INIT/DROTHER 00:00:33 10.0.1.104 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.43 1 EXCHANGE/DR 00:00:33 10.0.5.44 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.4.173) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.173\nAdvertising Router: 10.0.4.173\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.174 1 DOWN 00:00:33 10.0.2.152 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.1.150) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.150\nAdvertising Router: 10.0.1.150\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or unstable adjacency.", "local_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"], "neighbor_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.192 1 INIT/DROTHER 00:00:33 10.0.5.72 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.2.166) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.166\nAdvertising Router: 10.0.2.166\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or unstable adjacency.", "local_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"], "neighbor_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.215 1 EXSTART/DR 00:00:33 10.0.5.98 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.223 1 DOWN 00:00:33 10.0.1.194 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.247 1 EXSTART/DR 00:00:33 10.0.4.91 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.109 1 EXSTART/DR 00:00:33 10.0.1.75 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.136 1 EXCHANGE/DR 00:00:33 10.0.4.104 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.2.120) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.120\nAdvertising Router: 10.0.2.120\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.3 1 EXCHANGE/DR 00:00:33 10.0.3.201 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.3.197) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.197\nAdvertising Router: 10.0.3.197\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.85 1 DOWN 00:00:33 10.0.1.106 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.223 1 EXSTART/DR 00:00:33 10.0.1.103 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.48 1 DOWN 00:00:00 10.0.1.99 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.2.68) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.68\nAdvertising Router: 10.0.2.68\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or unstable adjacency.", "local_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"], "neighbor_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.19 1 EXCHANGE/DR 00:00:33 10.0.1.97 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.0.95) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.95\nAdvertising Router: 10.0.0.95\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.214 1 INIT/DROTHER 00:00:33 10.0.5.16 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.22 1 EXCHANGE/DR 00:00:33 10.0.5.60 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.1.197) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.197\nAdvertising Router: 10.0.1.197\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.15 1 DOWN 00:00:33 10.0.1.227 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.40 1 EXSTART/DR 00:00:33 10.0.2.236 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.136 1 INIT/DROTHER 00:00:33 10.0.3.138 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "CORE-R1"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.4.159) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.159\nAdvertising Router: 10.0.4.159\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or unstable adjacency.", "local_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"], "neighbor_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.5.227) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.5.227\nAdvertising Router: 10.0.5.227\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or unstable adjacency.", "local_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"], "neighbor_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.223 1 EXSTART/DR 00:00:33 10.0.4.236 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.175 1 LOADING/DR 00:00:33 10.0.2.42 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.2.100 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.165 1 EXCHANGE/DR 00:00:33 10.0.4.100 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.5.217) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.5.217\nAdvertising Router: 10.0.5.217\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.217 1 INIT/DROTHER 00:00:33 10.0.4.99 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync", "device": "CORE-R1"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.3.54) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.54\nAdvertising Router: 10.0.3.54\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or unstable adjacency.", "local_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"], "neighbor_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.19 1 DOWN 00:00:33 10.0.2.237 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.96 1 EXSTART/DR 00:00:33 10.0.2.243 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.79 1 LOADING/DR 00:00:33 10.0.3.213 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.1.14 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.91 1 LOADING/DR 00:00:33 10.0.4.15 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.4.60 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync", "device": "CORE-R1"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.1.176) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.176\nAdvertising Router: 10.0.1.176\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or unstable adjacency.", "local_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"], "neighbor_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.6 1 EXCHANGE/DR 00:00:33 10.0.2.207 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.4.28) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.28\nAdvertising Router: 10.0.4.28\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.5.11) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.5.11\nAdvertising Router: 10.0.5.11\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or unstable adjacency.", "local_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"], "neighbor_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.72 1 2-WAY/DROTHER 00:00:33 10.0.3.220 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.5 1 EXCHANGE/DR 00:00:33 10.0.2.145 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.4.217) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.217\nAdvertising Router: 10.0.4.217\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.152 1 2-WAY/DROTHER 00:00:33 10.0.4.79 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.202 1 2-WAY/DROTHER 00:00:33 10.0.1.11 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.70 1 INIT/DROTHER 00:00:33 10.0.2.196 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.134 1 LOADING/DR 00:00:33 10.0.4.195 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.3.184 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.253 1 EXSTART/DR 00:00:33 10.0.1.132 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.51 1 INIT/DROTHER 00:00:33 10.0.5.81 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.160 1 EXSTART/DR 00:00:33 10.0.2.196 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.246 1 INIT/DROTHER 00:00:33 10.0.5.80 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.243 1 DOWN 00:00:33 10.0.4.69 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.177 1 LOADING/DR 00:00:33 10.0.1.71 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.1.29 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.13 1 DOWN 00:00:33 10.0.1.23 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.244 1 DOWN 00:00:33 10.0.3.109 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.234 1 EXSTART/DR 00:00:33 10.0.1.221 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.159 1 INIT/DROTHER 00:00:33 10.0.1.52 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.216 1 EXSTART/DR 00:00:33 10.0.4.163 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.150 1 2-WAY/DROTHER 00:00:33 10.0.4.184 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.243 1 EXCHANGE/DR 00:00:33 10.0.2.61 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.2.181) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.181\nAdvertising Router: 10.0.2.181\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.1.61) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.61\nAdvertising Router: 10.0.1.61\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or unstable adjacency.", "local_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"], "neighbor_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.18 1 INIT/DROTHER 00:00:33 10.0.5.110 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.10 1 EXCHANGE/DR 00:00:33 10.0.3.65 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.2.123) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.123\nAdvertising Router: 10.0.2.123\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.65 1 INIT/DROTHER 00:00:33 10.0.4.66 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.98 1 EXCHANGE/DR 00:00:33 10.0.1.184 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.4.189) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.189\nAdvertising Router: 10.0.4.189\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.75 1 EXSTART/DR 00:00:33 10.0.5.94 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.37 1 2-WAY/DROTHER 00:00:33 10.0.1.99 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.163 1 INIT/DROTHER 00:00:33 10.0.2.9 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.154 1 LOADING/DR 00:00:33 10.0.2.69 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.5.104 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.136 1 LOADING/DR 00:00:33 10.0.2.61 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.3.126 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.230 1 EXSTART/DR 00:00:33 10.0.2.178 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.88 1 DOWN 00:00:33 10.0.2.73 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.227 1 DOWN 00:00:33 10.0.1.129 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.2.75) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.75\nAdvertising Router: 10.0.2.75\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or unstable adjacency.", "local_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"], "neighbor_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.131 1 EXCHANGE/DR 00:00:33 10.0.4.105 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.3.170) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.170\nAdvertising Router: 10.0.3.170\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.108 1 EXCHANGE/DR 00:00:33 10.0.2.33 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.2.75) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.75\nAdvertising Router: 10.0.2.75\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.187 1 DOWN 00:00:33 10.0.4.128 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.150 1 INIT/DROTHER 00:00:33 10.0.4.113 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.65 1 INIT/DROTHER 00:00:33 10.0.3.116 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.63 1 LOADING/DR 00:00:33 10.0.1.200 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.3.89 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.151 1 EXSTART/DR 00:00:33 10.0.3.99 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.71 1 LOADING/DR 00:00:33 10.0.3.150 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.1.122 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.81 1 DOWN 00:00:00 10.0.3.189 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.65 1 EXSTART/DR 00:00:33 10.0.4.40 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.144 1 EXSTART/DR 00:00:33 10.0.2.230 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.1.83) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.83\nAdvertising Router: 10.0.1.83\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or unstable adjacency.", "local_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"], "neighbor_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.18 1 EXSTART/DR 00:00:33 10.0.1.33 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.5.106) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.5.106\nAdvertising Router: 10.0.5.106\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or unstable adjacency.", "local_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"], "neighbor_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.59 1 DOWN 00:00:33 10.0.5.167 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.170 1 EXCHANGE/DR 00:00:33 10.0.1.107 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.0.58) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.58\nAdvertising Router: 10.0.0.58\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.97 1 EXSTART/DR 00:00:33 10.0.4.52 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.53 1 INIT/DROTHER 00:00:33 10.0.5.29 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.227 1 DOWN 00:00:00 10.0.4.236 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.110 1 EXSTART/DR 00:00:33 10.0.3.249 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.4.42) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.42\nAdvertising Router: 10.0.4.42\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or unstable adjacency.", "local_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"], "neighbor_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.170 1 EXSTART/DR 00:00:33 10.0.5.130 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.127 1 EXSTART/DR 00:00:33 10.0.2.68 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.136 1 EXSTART/DR 00:00:33 10.0.5.117 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.196 1 EXSTART/DR 00:00:33 10.0.4.43 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.147 1 DOWN 00:00:00 10.0.1.29 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.181 1 EXCHANGE/DR 00:00:33 10.0.2.219 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.1.82) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.82\nAdvertising Router: 10.0.1.82\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.227 1 EXSTART/DR 00:00:33 10.0.5.4 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.187 1 DOWN 00:00:33 10.0.4.203 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.65 1 INIT/DROTHER 00:00:33 10.0.5.130 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.112 1 LOADING/DR 00:00:33 10.0.1.183 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.4.62 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.201 1 EXCHANGE/DR 00:00:33 10.0.1.14 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.1.145) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.145\nAdvertising Router: 10.0.1.145\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.85 1 DOWN 00:00:33 10.0.4.240 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.89 1 DOWN 00:00:33 10.0.2.38 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.120 1 EXCHANGE/DR 00:00:33 10.0.2.243 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.1.35) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.35\nAdvertising Router: 10.0.1.35\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.178 1 LOADING/DR 00:00:33 10.0.3.191 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.4.130 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.47 1 INIT/DROTHER 00:00:33 10.0.3.48 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.28 1 INIT/DROTHER 00:00:33 10.0.5.132 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.157 1 INIT/DROTHER 00:00:33 10.0.2.110 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.71 1 DOWN 00:00:33 10.0.1.144 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.158 1 DOWN 00:00:33 10.0.3.41 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.71 1 INIT/DROTHER 00:00:33 10.0.2.184 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.207 1 2-WAY/DROTHER 00:00:33 10.0.1.239 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.62 1 EXSTART/DR 00:00:33 10.0.5.139 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.39 1 DOWN 00:00:00 10.0.1.17 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.115 1 LOADING/DR 00:00:33 10.0.3.252 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.5.65 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.1.77) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.77\nAdvertising Router: 10.0.1.77\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or unstable adjacency.", "local_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"], "neighbor_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.52 1 LOADING/DR 00:00:33 10.0.2.229 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.2.211 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.205 1 2-WAY/DROTHER 00:00:33 10.0.3.87 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.137 1 LOADING/DR 00:00:33 10.0.5.61 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.5.56 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.109 1 EXSTART/DR 00:00:33 10.0.1.21 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.131 1 LOADING/DR 00:00:33 10.0.1.223 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.5.229 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.157 1 EXSTART/DR 00:00:33 10.0.5.106 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.201 1 INIT/DROTHER 00:00:33 10.0.2.164 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.129 1 2-WAY/DROTHER 00:00:33 10.0.3.53 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.222 1 DOWN 00:00:00 10.0.5.54 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.240 1 EXSTART/DR 00:00:33 10.0.4.88 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.239 1 DOWN 00:00:33 10.0.3.108 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.107 1 EXSTART/DR 00:00:33 10.0.5.249 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.168 1 EXCHANGE/DR 00:00:33 10.0.4.34 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.0.222) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.222\nAdvertising Router: 10.0.0.222\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.241 1 INIT/DROTHER 00:00:33 10.0.4.45 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.224 1 LOADING/DR 00:00:33 10.0.3.135 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.4.182 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.139 1 LOADING/DR 00:00:33 10.0.1.8 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.4.85 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.77 1 DOWN 00:00:00 10.0.3.250 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.173 1 DOWN 00:00:00 10.0.1.105 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.206 1 INIT/DROTHER 00:00:33 10.0.1.231 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.50 1 LOADING/DR 00:00:33 10.0.1.193 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.5.1 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.243 1 EXSTART/DR 00:00:33 10.0.1.25 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.149 1 EXSTART/DR 00:00:33 10.0.5.168 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.214 1 LOADING/DR 00:00:33 10.0.2.173 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.2.108 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.144 1 LOADING/DR 00:00:33 10.0.2.56 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.3.23 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.95 1 EXCHANGE/DR 00:00:33 10.0.2.26 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.5.88) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.5.88\nAdvertising Router: 10.0.5.88\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.228 1 EXSTART/DR 00:00:33 10.0.2.95 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.166 1 DOWN 00:00:33 10.0.2.53 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.213 1 INIT/DROTHER 00:00:33 10.0.1.86 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.137 1 INIT/DROTHER 00:00:33 10.0.4.44 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.38 1 EXSTART/DR 00:00:33 10.0.1.154 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.43 1 EXSTART/DR 00:00:33 10.0.5.31 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.170 1 2-WAY/DROTHER 00:00:33 10.0.3.163 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.204 1 EXSTART/DR 00:00:33 10.0.2.113 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.69 1 INIT/DROTHER 00:00:33 10.0.3.43 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.63 1 INIT/DROTHER 00:00:33 10.0.1.41 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.41 1 INIT/DROTHER 00:00:33 10.0.3.36 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.211 1 LOADING/DR 00:00:33 10.0.1.34 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.4.98 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.126 1 EXSTART/DR 00:00:33 10.0.2.171 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.133 1 LOADING/DR 00:00:33 10.0.2.46 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.3.219 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.70 1 DOWN 00:00:00 10.0.2.26 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.247 1 INIT/DROTHER 00:00:33 10.0.1.51 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.162 1 LOADING/DR 00:00:33 10.0.2.67 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.4.95 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.93 1 EXSTART/DR 00:00:33 10.0.1.70 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.2.252) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.252\nAdvertising Router: 10.0.2.252\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or unstable adjacency.", "local_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"], "neighbor_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.253 1 LOADING/DR 00:00:33 10.0.4.199 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.3.213 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.11 1 INIT/DROTHER 00:00:33 10.0.1.172 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.156 1 EXSTART/DR 00:00:33 10.0.2.75 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.251 1 LOADING/DR 00:00:33 10.0.5.190 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.4.247 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.44 1 DOWN 00:00:33 10.0.3.179 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync", "device": "CORE-R1"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.4.193) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.193\nAdvertising Router: 10.0.4.193\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or unstable adjacency.", "local_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"], "neighbor_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.1.113) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.113\nAdvertising Router: 10.0.1.113\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or unstable adjacency.", "local_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"], "neighbor_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.235 1 EXCHANGE/DR 00:00:33 10.0.2.169 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.5.245) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.5.245\nAdvertising Router: 10.0.5.245\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.192 1 INIT/DROTHER 00:00:33 10.0.5.222 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.44 1 INIT/DROTHER 00:00:33 10.0.5.253 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.17 1 INIT/DROTHER 00:00:33 10.0.5.209 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.60 1 INIT/DROTHER 00:00:33 10.0.5.239 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.188 1 EXCHANGE/DR 00:00:33 10.0.3.82 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.4.214) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.214\nAdvertising Router: 10.0.4.214\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.171 1 INIT/DROTHER 00:00:33 10.0.5.215 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.252 1 EXSTART/DR 00:00:33 10.0.5.109 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.52 1 EXSTART/DR 00:00:33 10.0.1.148 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.71 1 INIT/DROTHER 00:00:33 10.0.2.107 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.1 1 INIT/DROTHER 00:00:33 10.0.5.189 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.196 1 DOWN 00:00:33 10.0.2.169 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.71 1 INIT/DROTHER 00:00:33 10.0.4.221 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.209 1 INIT/DROTHER 00:00:33 10.0.2.218 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.87 1 DOWN 00:00:33 10.0.5.11 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "CORE-R1"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.2.131) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.131\nAdvertising Router: 10.0.2.131\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or unstable adjacency.", "local_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"], "neighbor_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.57 1 DOWN 00:00:00 10.0.1.53 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.78 1 DOWN 00:00:33 10.0.3.41 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.6 1 INIT/DROTHER 00:00:33 10.0.4.130 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.86 1 INIT/DROTHER 00:00:33 10.0.5.242 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.101 1 EXSTART/DR 00:00:33 10.0.3.104 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.221 1 DOWN 00:00:33 10.0.5.59 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.6 1 EXCHANGE/DR 00:00:33 10.0.4.86 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.1.98) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.98\nAdvertising Router: 10.0.1.98\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.170 1 EXCHANGE/DR 00:00:33 10.0.3.45 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.3.222) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.222\nAdvertising Router: 10.0.3.222\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.39 1 DOWN 00:00:33 10.0.4.62 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.115 1 INIT/DROTHER 00:00:33 10.0.3.60 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.139 1 DOWN 00:00:33 10.0.3.212 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.250 1 LOADING/DR 00:00:33 10.0.1.23 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.0.178 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.231 1 EXSTART/DR 00:00:33 10.0.1.57 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.31 1 2-WAY/DROTHER 00:00:33 10.0.3.99 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.103 1 LOADING/DR 00:00:33 10.0.2.102 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.0.133 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.196 1 EXSTART/DR 00:00:33 10.0.4.68 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.122 1 LOADING/DR 00:00:33 10.0.4.224 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.4.179 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.225 1 EXCHANGE/DR 00:00:33 10.0.4.143 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.2.2) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.2\nAdvertising Router: 10.0.2.2\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.108 1 INIT/DROTHER 00:00:33 10.0.3.116 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "CORE-R1"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.0.153) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.153\nAdvertising Router: 10.0.0.153\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or unstable adjacency.", "local_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"], "neighbor_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.168 1 DOWN 00:00:00 10.0.5.120 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.94 1 EXSTART/DR 00:00:33 10.0.4.208 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.163 1 LOADING/DR 00:00:33 10.0.4.78 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.4.191 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.207 1 DOWN 00:00:33 10.0.2.48 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.244 1 DOWN 00:00:33 10.0.5.218 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.184 1 EXSTART/DR 00:00:33 10.0.4.233 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.28 1 EXCHANGE/DR 00:00:33 10.0.4.181 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.5.109) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.5.109\nAdvertising Router: 10.0.5.109\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.222 1 DOWN 00:00:00 10.0.2.91 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.39 1 DOWN 00:00:00 10.0.2.121 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.197 1 INIT/DROTHER 00:00:33 10.0.3.40 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.15 1 2-WAY/DROTHER 00:00:33 10.0.1.28 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.191 1 2-WAY/DROTHER 00:00:33 10.0.3.39 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.150 1 LOADING/DR 00:00:33 10.0.4.70 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.3.49 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.3.111) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.111\nAdvertising Router: 10.0.3.111\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or unstable adjacency.", "local_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"], "neighbor_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.29 1 DOWN 00:00:33 10.0.3.74 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.9 1 2-WAY/DROTHER 00:00:33 10.0.4.215 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.12 1 DOWN 00:00:33 10.0.2.165 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.15 1 INIT/DROTHER 00:00:33 10.0.5.19 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.153 1 LOADING/DR 00:00:33 10.0.1.94 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.1.58 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.157 1 EXSTART/DR 00:00:33 10.0.4.141 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.100 1 EXSTART/DR 00:00:33 10.0.4.197 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.130 1 DOWN 00:00:00 10.0.1.14 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.189 1 LOADING/DR 00:00:33 10.0.3.132 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.1.14 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.214 1 2-WAY/DROTHER 00:00:33 10.0.1.78 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.80 1 EXSTART/DR 00:00:33 10.0.5.136 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.52 1 2-WAY/DROTHER 00:00:33 10.0.2.160 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.52 1 DOWN 00:00:33 10.0.3.19 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.91 1 DOWN 00:00:00 10.0.5.218 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.103 1 2-WAY/DROTHER 00:00:33 10.0.1.170 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.167 1 EXSTART/DR 00:00:33 10.0.4.194 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.188 1 INIT/DROTHER 00:00:33 10.0.5.74 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.124 1 2-WAY/DROTHER 00:00:33 10.0.3.20 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.37 1 DOWN 00:00:00 10.0.4.63 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.205 1 DOWN 00:00:33 10.0.4.89 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.3.149) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.149\nAdvertising Router: 10.0.3.149\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or unstable adjacency.", "local_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"], "neighbor_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.117 1 DOWN 00:00:00 10.0.2.115 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.90 1 EXCHANGE/DR 00:00:33 10.0.3.92 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.5.245) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.5.245\nAdvertising Router: 10.0.5.245\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.208 1 2-WAY/DROTHER 00:00:33 10.0.4.182 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.109 1 DOWN 00:00:33 10.0.3.214 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.122 1 LOADING/DR 00:00:33 10.0.2.195 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.2.39 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.188 1 INIT/DROTHER 00:00:33 10.0.3.10 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.115 1 EXCHANGE/DR 00:00:33 10.0.5.46 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.3.185) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.185\nAdvertising Router: 10.0.3.185\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.7 1 DOWN 00:00:33 10.0.3.44 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.231 1 EXSTART/DR 00:00:33 10.0.1.184 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.179 1 EXSTART/DR 00:00:33 10.0.2.131 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.134 1 INIT/DROTHER 00:00:33 10.0.2.62 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.107 1 DOWN 00:00:00 10.0.3.128 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.5 1 EXSTART/DR 00:00:33 10.0.4.221 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.20 1 INIT/DROTHER 00:00:33 10.0.3.28 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.230 1 DOWN 00:00:33 10.0.1.144 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.31 1 DOWN 00:00:33 10.0.2.133 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.4.164) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.164\nAdvertising Router: 10.0.4.164\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or unstable adjacency.", "local_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"], "neighbor_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.191 1 2-WAY/DROTHER 00:00:33 10.0.1.26 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.194 1 INIT/DROTHER 00:00:33 10.0.5.49 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.227 1 DOWN 00:00:00 10.0.1.115 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.138 1 DOWN 00:00:00 10.0.2.186 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.1.150) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.150\nAdvertising Router: 10.0.1.150\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or unstable adjacency.", "local_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"], "neighbor_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.196 1 INIT/DROTHER 00:00:33 10.0.3.36 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.131 1 2-WAY/DROTHER 00:00:33 10.0.5.188 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.129 1 INIT/DROTHER 00:00:33 10.0.4.56 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.13 1 DOWN 00:00:33 10.0.4.19 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.124 1 EXSTART/DR 00:00:33 10.0.1.229 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.180 1 INIT/DROTHER 00:00:33 10.0.5.34 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.185 1 LOADING/DR 00:00:33 10.0.1.112 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.3.182 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.59 1 INIT/DROTHER 00:00:33 10.0.1.124 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.1.42) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.42\nAdvertising Router: 10.0.1.42\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or unstable adjacency.", "local_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"], "neighbor_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.124 1 INIT/DROTHER 00:00:33 10.0.2.31 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.143 1 DOWN 00:00:00 10.0.4.3 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.4.76) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.4.76\nAdvertising Router: 10.0.4.76\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or unstable adjacency.", "local_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"], "neighbor_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "CORE-R1"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.2.210) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.210\nAdvertising Router: 10.0.2.210\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or unstable adjacency.", "local_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"], "neighbor_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.143 1 DOWN 00:00:00 10.0.4.139 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.5 1 EXSTART/DR 00:00:33 10.0.2.137 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.34 1 EXSTART/DR 00:00:33 10.0.1.192 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.221 1 2-WAY/DROTHER 00:00:33 10.0.2.191 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.245 1 DOWN 00:00:33 10.0.3.192 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.21 1 EXCHANGE/DR 00:00:33 10.0.1.90 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.0.189) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.189\nAdvertising Router: 10.0.0.189\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.59 1 INIT/DROTHER 00:00:33 10.0.4.213 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.204 1 EXSTART/DR 00:00:33 10.0.5.149 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.156 1 EXCHANGE/DR 00:00:33 10.0.5.9 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.2.38) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.38\nAdvertising Router: 10.0.2.38\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.23 1 EXSTART/DR 00:00:33 10.0.2.239 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.246 1 DOWN 00:00:33 10.0.5.222 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.171 1 EXCHANGE/DR 00:00:33 10.0.2.123 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.1.191) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.191\nAdvertising Router: 10.0.1.191\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.251 1 INIT/DROTHER 00:00:33 10.0.2.42 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.170 1 DOWN 00:00:00 10.0.1.186 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.128 1 EXCHANGE/DR 00:00:33 10.0.2.88 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.1.234) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.234\nAdvertising Router: 10.0.1.234\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.6 1 2-WAY/DROTHER 00:00:33 10.0.3.56 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.55 1 DOWN 00:00:00 10.0.5.148 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.244 1 EXCHANGE/DR 00:00:33 10.0.5.41 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.2.119) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.119\nAdvertising Router: 10.0.2.119\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.68 1 EXSTART/DR 00:00:33 10.0.3.2 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.170 1 DOWN 00:00:33 10.0.1.153 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.88 1 LOADING/DR 00:00:33 10.0.5.28 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.2.160 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.125 1 EXSTART/DR 00:00:33 10.0.1.106 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.185 1 EXSTART/DR 00:00:33 10.0.2.179 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.156 1 EXSTART/DR 00:00:33 10.0.5.35 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.70 1 EXSTART/DR 00:00:33 10.0.5.118 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.51 1 EXSTART/DR 00:00:33 10.0.2.233 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.99 1 INIT/DROTHER 00:00:33 10.0.2.142 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.114 1 LOADING/DR 00:00:33 10.0.2.29 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.2.88 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.164 1 INIT/DROTHER 00:00:33 10.0.1.206 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.26 1 2-WAY/DROTHER 00:00:33 10.0.2.61 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.220 1 EXSTART/DR 00:00:33 10.0.4.254 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.161 1 EXSTART/DR 00:00:33 10.0.1.62 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "CORE-R1"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.1.58) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.58\nAdvertising Router: 10.0.1.58\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or unstable adjacency.", "local_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"], "neighbor_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.177 1 INIT/DROTHER 00:00:33 10.0.5.60 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync", "device": "CORE-R1"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.1.78) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.78\nAdvertising Router: 10.0.1.78\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or unstable adjacency.", "local_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"], "neighbor_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.203 1 EXSTART/DR 00:00:33 10.0.4.133 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.180 1 EXCHANGE/DR 00:00:33 10.0.1.194 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.5.139) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.5.139\nAdvertising Router: 10.0.5.139\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.143 1 INIT/DROTHER 00:00:33 10.0.1.49 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.85 1 EXSTART/DR 00:00:33 10.0.4.36 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.131 1 EXSTART/DR 00:00:33 10.0.4.37 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.142 1 INIT/DROTHER 00:00:33 10.0.1.104 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.10 1 DOWN 00:00:33 10.0.1.33 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.176 1 2-WAY/DROTHER 00:00:33 10.0.5.71 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.191 1 EXSTART/DR 00:00:33 10.0.1.216 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.43 1 DOWN 00:00:00 10.0.4.172 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.210 1 DOWN 00:00:33 10.0.4.219 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.218 1 2-WAY/DROTHER 00:00:33 10.0.3.206 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.110 1 2-WAY/DROTHER 00:00:33 10.0.2.88 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.162 1 INIT/DROTHER 00:00:33 10.0.1.64 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.180 1 EXCHANGE/DR 00:00:33 10.0.1.144 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.0.80) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.80\nAdvertising Router: 10.0.0.80\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.2.196) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.196\nAdvertising Router: 10.0.2.196\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or unstable adjacency.", "local_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"], "neighbor_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.208 1 INIT/DROTHER 00:00:33 10.0.3.241 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.104 1 LOADING/DR 00:00:33 10.0.4.94 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.5.177 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.162 1 2-WAY/DROTHER 00:00:33 10.0.1.242 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.117 1 2-WAY/DROTHER 00:00:33 10.0.1.133 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.175 1 EXCHANGE/DR 00:00:33 10.0.2.2 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.3.23) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.23\nAdvertising Router: 10.0.3.23\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.115 1 EXSTART/DR 00:00:33 10.0.3.156 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.55 1 EXSTART/DR 00:00:33 10.0.3.159 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.39 1 EXCHANGE/DR 00:00:33 10.0.1.169 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.1.21) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.21\nAdvertising Router: 10.0.1.21\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.248 1 EXSTART/DR 00:00:33 10.0.2.10 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync", "device": "CORE-R1"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.3.182) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.182\nAdvertising Router: 10.0.3.182\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or unstable adjacency.", "local_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"], "neighbor_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.40 1 2-WAY/DROTHER 00:00:33 10.0.3.231 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.98 1 EXSTART/DR 00:00:33 10.0.2.229 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.115 1 DOWN 00:00:33 10.0.3.122 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/2", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.20 1 LOADING/DR 00:00:33 10.0.1.74 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.0.221 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.95 1 EXCHANGE/DR 00:00:33 10.0.3.97 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.1.40) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.40\nAdvertising Router: 10.0.1.40\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.185 1 2-WAY/DROTHER 00:00:33 10.0.5.18 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.106 1 EXSTART/DR 00:00:33 10.0.4.34 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.229 1 INIT/DROTHER 00:00:33 10.0.4.170 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.220 1 EXSTART/DR 00:00:33 10.0.1.240 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.192 1 EXCHANGE/DR 00:00:33 10.0.5.25 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.0.154) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.154\nAdvertising Router: 10.0.0.154\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.199 1 DOWN 00:00:00 10.0.4.128 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.37 1 2-WAY/DROTHER 00:00:33 10.0.4.127 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.127 1 INIT/DROTHER 00:00:33 10.0.3.49 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.62 1 EXSTART/DR 00:00:33 10.0.4.161 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.81 1 INIT/DROTHER 00:00:33 10.0.3.157 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "BRANCH-RTR1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.6 1 INIT/DROTHER 00:00:33 10.0.2.237 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.41 1 LOADING/DR 00:00:33 10.0.2.168 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.1.220 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF network command.", "local_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.2.0 0.0.0.255 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.127 1 2-WAY/DROTHER 00:00:33 10.0.4.223 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.4 1 EXCHANGE/DR 00:00:33 10.0.4.147 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.1.141) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.141\nAdvertising Router: 10.0.1.141\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.95 1 2-WAY/DROTHER 00:00:33 10.0.5.99 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "BRANCH-RTR1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.229 1 INIT/DROTHER 00:00:33 10.0.2.136 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.16 1 LOADING/DR 00:00:33 10.0.1.129 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.1.98 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.101 1 DOWN 00:00:33 10.0.5.49 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.136 1 2-WAY/DROTHER 00:00:33 10.0.5.248 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.149 1 INIT/DROTHER 00:00:33 10.0.2.42 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.127 1 DOWN 00:00:00 10.0.5.223 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.35 1 EXCHANGE/DR 00:00:33 10.0.1.131 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.0.203) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.203\nAdvertising Router: 10.0.0.203\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.86 1 INIT/DROTHER 00:00:33 10.0.2.58 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.46 1 2-WAY/DROTHER 00:00:33 10.0.2.93 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "Multi-access DR/BDR election behavior.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf priority 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.190 1 INIT/DROTHER 00:00:33 10.0.5.128 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.19 1 DOWN 00:00:00 10.0.3.44 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 5, Output errors: 3\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or interface not fully configured for OSPF.", "local_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " no shutdown", " ip ospf 1 area 0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.110 1 LOADING/DR 00:00:33 10.0.5.27 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.3.86 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.38 1 INIT/DROTHER 00:00:33 10.0.2.164 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "CORE-R1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.167 1 DOWN 00:00:00 10.0.4.48 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.71 1 DOWN 00:00:00 10.0.2.193 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.196 1 DOWN 00:00:00 10.0.2.131 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.10 1 EXSTART/DR 00:00:33 10.0.1.250 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW2", "neighbor_device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW2"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.67 1 DOWN 00:00:00 10.0.3.75 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.0.183 1 LOADING/DR 00:00:33 10.0.2.133 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.1.74 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id between neighbors.", "root_cause": "Two routers share the same router-id.", "local_fix_cli": ["router ospf 1", " router-id 10.255.255.1", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["router ospf 1", " router-id 10.255.255.2", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.183 1 INIT/DROTHER 00:00:33 10.0.5.59 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos seen from neighbor, but 2-Way not achieved, possibly unidirectional link or ACL issue.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf network broadcast", " no ip ospf passive-interface", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.114 1 INIT/DROTHER 00:00:33 10.0.4.64 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects Area 1.", "local_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"], "neighbor_fix_cli": ["router ospf 1", " network 10.0.4.0 0.0.0.255 area 1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.77 1 EXSTART/DR 00:00:33 10.0.4.123 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.139 1 EXCHANGE/DR 00:00:33 10.0.3.75 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.5.163) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.5.163\nAdvertising Router: 10.0.5.163\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange, typically MTU or LSA problems.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip mtu 1500", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "CORE-R1", "neighbor_device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch", "device": "CORE-R1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.70 1 EXSTART/DR 00:00:33 10.0.2.69 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip mtu 1400", " ip ospf mtu-ignore", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "ACCESS-SW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch", "device": "ACCESS-SW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.5.125 1 DOWN 00:00:00 10.0.3.6 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failing due to mismatched hello/dead timers.", "root_cause": "Hello/dead intervals differ between neighbors.", "local_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"], "neighbor_fix_cli": ["interface GigabitEthernet0/0", " ip ospf hello-interval 10", " ip ospf dead-interval 40", "exit", "clear ip ospf process"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.2.211) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.211\nAdvertising Router: 10.0.2.211\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or unstable adjacency.", "local_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"], "neighbor_fix_cli": ["clear ip ospf process", "clear ip ospf neighbor *"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "EDGE-FW1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch", "device": "EDGE-FW1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.176 1 EXSTART/DR 00:00:33 10.0.1.51 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/1", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.28 1 DOWN 00:00:33 10.0.3.25 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/0", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.82 1 DOWN 00:00:33 10.0.1.51 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface is configured as passive under OSPF.", "local_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"], "neighbor_fix_cli": ["router ospf 1", " no passive-interface GigabitEthernet0/1", "exit"]}} {"instruction": "Analyze the OSPF incident and propose configuration fixes.", "device": "BRANCH-RTR1", "neighbor_device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch", "device": "BRANCH-RTR1"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.4.233 1 EXSTART/DR 00:00:33 10.0.4.253 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication settings or keys on neighbors.", "local_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"], "neighbor_fix_cli": ["interface GigabitEthernet0/2", " ip ospf authentication message-digest", " ip ospf message-digest-key 1 md5 SECRETKEY", "exit"]}}