{"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.181 1 2-WAY/DROTHER 00:00:33 10.0.1.150 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.33 1 LOADING/DR 00:00:33 10.0.3.165 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.1.64 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.147 1 EXSTART/DR 00:00:33 10.0.2.127 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.254 1 DOWN 00:00:00 10.0.2.101 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.142 1 DOWN 00:00:33 10.0.3.208 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.242 1 INIT/DROTHER 00:00:33 10.0.1.168 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.168 1 2-WAY/DROTHER 00:00:33 10.0.1.62 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.41 1 DOWN 00:00:00 10.0.1.188 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.7 1 2-WAY/DROTHER 00:00:33 10.0.3.75 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.62 1 DOWN 00:00:00 10.0.2.5 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.100 1 EXCHANGE/DR 00:00:33 10.0.1.214 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.2.236) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.236\nAdvertising Router: 10.0.2.236\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.229 1 2-WAY/DROTHER 00:00:33 10.0.1.153 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.214 1 EXSTART/DR 00:00:33 10.0.3.139 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.78 1 2-WAY/DROTHER 00:00:33 10.0.2.184 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.2.198) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.198\nAdvertising Router: 10.0.2.198\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.221 1 DOWN 00:00:33 10.0.2.62 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.235 1 EXSTART/DR 00:00:33 10.0.1.251 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.231 1 EXCHANGE/DR 00:00:33 10.0.1.16 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.0.101) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.101\nAdvertising Router: 10.0.0.101\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.143 1 DOWN 00:00:00 10.0.2.103 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.124 1 INIT/DROTHER 00:00:33 10.0.3.94 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.244 1 DOWN 00:00:33 10.0.1.83 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.3.5) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.5\nAdvertising Router: 10.0.3.5\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.2 1 EXCHANGE/DR 00:00:33 10.0.2.187 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.0.203) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.203\nAdvertising Router: 10.0.0.203\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.160 1 EXSTART/DR 00:00:33 10.0.3.161 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.48 1 EXCHANGE/DR 00:00:33 10.0.2.146 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.1.135) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.135\nAdvertising Router: 10.0.1.135\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.173 1 DOWN 00:00:00 10.0.1.112 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.208 1 LOADING/DR 00:00:33 10.0.1.203 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.2.158 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.239 1 DOWN 00:00:00 10.0.2.45 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.3.192) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.192\nAdvertising Router: 10.0.3.192\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.61 1 INIT/DROTHER 00:00:33 10.0.2.76 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.192 1 EXSTART/DR 00:00:33 10.0.3.32 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.187 1 DOWN 00:00:33 10.0.1.150 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.139 1 LOADING/DR 00:00:33 10.0.2.87 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.0.180 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.124 1 EXSTART/DR 00:00:33 10.0.2.186 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.43 1 DOWN 00:00:00 10.0.1.180 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.208 1 LOADING/DR 00:00:33 10.0.1.36 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.2.186 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.187 1 EXSTART/DR 00:00:33 10.0.3.151 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.23 1 2-WAY/DROTHER 00:00:33 10.0.1.213 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.217 1 2-WAY/DROTHER 00:00:33 10.0.3.236 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.248 1 INIT/DROTHER 00:00:33 10.0.3.91 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.100 1 2-WAY/DROTHER 00:00:33 10.0.1.186 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.142 1 DOWN 00:00:33 10.0.2.216 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.242 1 DOWN 00:00:33 10.0.1.234 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.3.174) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.174\nAdvertising Router: 10.0.3.174\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.67 1 EXSTART/DR 00:00:33 10.0.2.28 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.207 1 INIT/DROTHER 00:00:33 10.0.1.143 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.227 1 EXCHANGE/DR 00:00:33 10.0.3.7 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.0.213) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.213\nAdvertising Router: 10.0.0.213\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.181 1 LOADING/DR 00:00:33 10.0.1.179 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.0.102 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.34 1 LOADING/DR 00:00:33 10.0.2.164 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.2.102 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.130 1 DOWN 00:00:33 10.0.3.155 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.67 1 INIT/DROTHER 00:00:33 10.0.1.194 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.0.94) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.94\nAdvertising Router: 10.0.0.94\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.165 1 EXSTART/DR 00:00:33 10.0.3.57 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.172 1 EXSTART/DR 00:00:33 10.0.2.245 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.97 1 INIT/DROTHER 00:00:33 10.0.1.164 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.187 1 EXSTART/DR 00:00:33 10.0.2.96 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.203 1 DOWN 00:00:00 10.0.2.224 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.184 1 LOADING/DR 00:00:33 10.0.1.23 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.1.151 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.62 1 EXSTART/DR 00:00:33 10.0.1.21 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.130 1 EXCHANGE/DR 00:00:33 10.0.2.116 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.3.203) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.203\nAdvertising Router: 10.0.3.203\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.25 1 2-WAY/DROTHER 00:00:33 10.0.3.85 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.86 1 INIT/DROTHER 00:00:33 10.0.1.41 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.202 1 INIT/DROTHER 00:00:33 10.0.3.165 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.87 1 INIT/DROTHER 00:00:33 10.0.3.50 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.96 1 DOWN 00:00:00 10.0.1.39 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.70 1 DOWN 00:00:00 10.0.2.78 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.137 1 EXCHANGE/DR 00:00:33 10.0.3.98 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.2.240) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.240\nAdvertising Router: 10.0.2.240\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.62 1 EXCHANGE/DR 00:00:33 10.0.3.230 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.2.138) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.138\nAdvertising Router: 10.0.2.138\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.2.97) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.97\nAdvertising Router: 10.0.2.97\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.228 1 EXSTART/DR 00:00:33 10.0.3.13 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.137 1 EXCHANGE/DR 00:00:33 10.0.3.111 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.1.221) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.221\nAdvertising Router: 10.0.1.221\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.144 1 DOWN 00:00:00 10.0.2.230 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.79 1 2-WAY/DROTHER 00:00:33 10.0.3.191 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.1.124) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.124\nAdvertising Router: 10.0.1.124\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.165 1 DOWN 00:00:00 10.0.2.66 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.168 1 DOWN 00:00:33 10.0.2.60 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.234 1 INIT/DROTHER 00:00:33 10.0.2.218 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.69 1 EXCHANGE/DR 00:00:33 10.0.3.181 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.2.69) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.69\nAdvertising Router: 10.0.2.69\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.5 1 EXSTART/DR 00:00:33 10.0.2.42 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.236 1 EXSTART/DR 00:00:33 10.0.3.24 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.213 1 EXSTART/DR 00:00:33 10.0.2.152 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.146 1 EXCHANGE/DR 00:00:33 10.0.1.105 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.3.112) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.112\nAdvertising Router: 10.0.3.112\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.251 1 EXSTART/DR 00:00:33 10.0.3.63 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.241 1 DOWN 00:00:00 10.0.3.39 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.44 1 EXCHANGE/DR 00:00:33 10.0.3.88 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.0.96) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.96\nAdvertising Router: 10.0.0.96\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.209 1 EXSTART/DR 00:00:33 10.0.1.254 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.221 1 DOWN 00:00:33 10.0.2.80 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.68 1 DOWN 00:00:00 10.0.3.126 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.247 1 INIT/DROTHER 00:00:33 10.0.1.176 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.74 1 EXSTART/DR 00:00:33 10.0.1.241 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.39 1 INIT/DROTHER 00:00:33 10.0.3.44 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.108 1 INIT/DROTHER 00:00:33 10.0.1.133 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.61 1 INIT/DROTHER 00:00:33 10.0.2.123 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.100 1 LOADING/DR 00:00:33 10.0.2.114 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.0.72 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.81 1 EXSTART/DR 00:00:33 10.0.2.25 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.167 1 INIT/DROTHER 00:00:33 10.0.3.249 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.237 1 INIT/DROTHER 00:00:33 10.0.3.123 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.157 1 2-WAY/DROTHER 00:00:33 10.0.2.11 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.134 1 DOWN 00:00:00 10.0.3.32 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.122 1 DOWN 00:00:00 10.0.1.222 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.93 1 DOWN 00:00:33 10.0.1.11 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.23 1 EXSTART/DR 00:00:33 10.0.1.15 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.2.239) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.239\nAdvertising Router: 10.0.2.239\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.184 1 LOADING/DR 00:00:33 10.0.3.191 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.1.148 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.3.251) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.251\nAdvertising Router: 10.0.3.251\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.189 1 EXSTART/DR 00:00:33 10.0.1.205 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.181 1 2-WAY/DROTHER 00:00:33 10.0.3.155 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.3 1 INIT/DROTHER 00:00:33 10.0.2.147 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.150 1 INIT/DROTHER 00:00:33 10.0.1.96 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.203 1 EXSTART/DR 00:00:33 10.0.1.242 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.244 1 INIT/DROTHER 00:00:33 10.0.2.106 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.3.19) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.19\nAdvertising Router: 10.0.3.19\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.234 1 2-WAY/DROTHER 00:00:33 10.0.2.236 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.34 1 EXSTART/DR 00:00:33 10.0.2.160 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.143 1 2-WAY/DROTHER 00:00:33 10.0.3.132 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.151 1 EXSTART/DR 00:00:33 10.0.2.226 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.0.233) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.233\nAdvertising Router: 10.0.0.233\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.41 1 DOWN 00:00:33 10.0.1.61 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.163 1 LOADING/DR 00:00:33 10.0.3.177 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.1.118 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.33 1 DOWN 00:00:00 10.0.2.100 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.3.79) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.79\nAdvertising Router: 10.0.3.79\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.93 1 DOWN 00:00:33 10.0.1.123 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.26 1 INIT/DROTHER 00:00:33 10.0.2.49 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.126 1 INIT/DROTHER 00:00:33 10.0.1.194 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.26 1 2-WAY/DROTHER 00:00:33 10.0.3.161 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.152 1 EXCHANGE/DR 00:00:33 10.0.2.175 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.3.172) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.172\nAdvertising Router: 10.0.3.172\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.133 1 EXSTART/DR 00:00:33 10.0.1.123 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.148 1 INIT/DROTHER 00:00:33 10.0.1.171 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.231 1 2-WAY/DROTHER 00:00:33 10.0.2.245 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.200 1 EXSTART/DR 00:00:33 10.0.1.25 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.49 1 2-WAY/DROTHER 00:00:33 10.0.1.252 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.101 1 2-WAY/DROTHER 00:00:33 10.0.3.173 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.130 1 DOWN 00:00:33 10.0.1.19 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.218 1 INIT/DROTHER 00:00:33 10.0.2.220 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.8 1 DOWN 00:00:33 10.0.1.92 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.91 1 INIT/DROTHER 00:00:33 10.0.1.17 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.115 1 INIT/DROTHER 00:00:33 10.0.1.128 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.2.242) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.242\nAdvertising Router: 10.0.2.242\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.18 1 EXCHANGE/DR 00:00:33 10.0.2.31 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.3.107) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.107\nAdvertising Router: 10.0.3.107\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.235 1 INIT/DROTHER 00:00:33 10.0.2.222 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.95 1 INIT/DROTHER 00:00:33 10.0.2.67 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.172 1 DOWN 00:00:33 10.0.1.146 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.184 1 DOWN 00:00:33 10.0.3.134 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.17 1 EXCHANGE/DR 00:00:33 10.0.2.121 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.0.26) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.26\nAdvertising Router: 10.0.0.26\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.35 1 INIT/DROTHER 00:00:33 10.0.2.11 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.59 1 LOADING/DR 00:00:33 10.0.1.43 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.1.125 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.63 1 2-WAY/DROTHER 00:00:33 10.0.3.195 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.3.229) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.229\nAdvertising Router: 10.0.3.229\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.163 1 DOWN 00:00:00 10.0.2.71 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.35 1 EXSTART/DR 00:00:33 10.0.3.117 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.219 1 DOWN 00:00:00 10.0.2.121 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.25 1 DOWN 00:00:33 10.0.1.44 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.248 1 EXSTART/DR 00:00:33 10.0.3.246 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.198 1 EXSTART/DR 00:00:33 10.0.3.65 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.204 1 EXSTART/DR 00:00:33 10.0.1.177 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.180 1 DOWN 00:00:00 10.0.1.67 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.239 1 INIT/DROTHER 00:00:33 10.0.2.115 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.248 1 DOWN 00:00:00 10.0.1.17 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.180 1 INIT/DROTHER 00:00:33 10.0.1.125 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.243 1 EXSTART/DR 00:00:33 10.0.2.164 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.91 1 INIT/DROTHER 00:00:33 10.0.2.96 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.51 1 LOADING/DR 00:00:33 10.0.3.36 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.0.194 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.152 1 EXSTART/DR 00:00:33 10.0.3.79 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.21 1 INIT/DROTHER 00:00:33 10.0.1.154 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.85 1 INIT/DROTHER 00:00:33 10.0.2.108 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.233 1 DOWN 00:00:00 10.0.2.36 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.94 1 2-WAY/DROTHER 00:00:33 10.0.3.243 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.60 1 EXSTART/DR 00:00:33 10.0.3.19 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.0.65) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.65\nAdvertising Router: 10.0.0.65\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.194 1 EXSTART/DR 00:00:33 10.0.2.153 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.7 1 2-WAY/DROTHER 00:00:33 10.0.1.130 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.1 1 INIT/DROTHER 00:00:33 10.0.1.133 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.210 1 EXCHANGE/DR 00:00:33 10.0.1.109 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.3.160) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.160\nAdvertising Router: 10.0.3.160\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.167 1 LOADING/DR 00:00:33 10.0.1.164 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.1.62 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.137 1 DOWN 00:00:00 10.0.1.79 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.249 1 LOADING/DR 00:00:33 10.0.1.81 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.1.249 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.144 1 2-WAY/DROTHER 00:00:33 10.0.2.124 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.104 1 EXSTART/DR 00:00:33 10.0.1.27 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.87 1 EXSTART/DR 00:00:33 10.0.1.93 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.3.195) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.195\nAdvertising Router: 10.0.3.195\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.52 1 DOWN 00:00:33 10.0.2.199 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.195 1 INIT/DROTHER 00:00:33 10.0.1.156 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.3.248) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.248\nAdvertising Router: 10.0.3.248\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.130 1 INIT/DROTHER 00:00:33 10.0.1.178 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.43 1 LOADING/DR 00:00:33 10.0.2.99 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.1.169 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.1.54) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.54\nAdvertising Router: 10.0.1.54\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.147 1 LOADING/DR 00:00:33 10.0.2.149 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.1.63 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.28 1 EXCHANGE/DR 00:00:33 10.0.1.138 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.1.171) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.171\nAdvertising Router: 10.0.1.171\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.29 1 EXCHANGE/DR 00:00:33 10.0.3.102 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.1.191) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.191\nAdvertising Router: 10.0.1.191\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.173 1 DOWN 00:00:00 10.0.2.167 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.3.10) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.10\nAdvertising Router: 10.0.3.10\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.134 1 INIT/DROTHER 00:00:33 10.0.2.93 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.159 1 LOADING/DR 00:00:33 10.0.2.249 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.2.38 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.94 1 EXSTART/DR 00:00:33 10.0.2.245 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.62 1 INIT/DROTHER 00:00:33 10.0.1.149 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.213 1 EXCHANGE/DR 00:00:33 10.0.2.147 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.2.163) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.163\nAdvertising Router: 10.0.2.163\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.202 1 DOWN 00:00:33 10.0.1.141 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.17 1 INIT/DROTHER 00:00:33 10.0.3.36 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.200 1 EXSTART/DR 00:00:33 10.0.1.146 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.234 1 EXCHANGE/DR 00:00:33 10.0.3.120 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.2.123) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.123\nAdvertising Router: 10.0.2.123\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.222 1 EXCHANGE/DR 00:00:33 10.0.1.124 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.0.207) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.207\nAdvertising Router: 10.0.0.207\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.108 1 2-WAY/DROTHER 00:00:33 10.0.1.201 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.1.162) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.162\nAdvertising Router: 10.0.1.162\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.252 1 INIT/DROTHER 00:00:33 10.0.3.130 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.99 1 EXCHANGE/DR 00:00:33 10.0.1.13 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.1.54) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.54\nAdvertising Router: 10.0.1.54\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.163 1 INIT/DROTHER 00:00:33 10.0.3.184 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.228 1 EXCHANGE/DR 00:00:33 10.0.1.11 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.0.108) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.108\nAdvertising Router: 10.0.0.108\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.72 1 INIT/DROTHER 00:00:33 10.0.3.74 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.203 1 2-WAY/DROTHER 00:00:33 10.0.1.26 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.29 1 EXSTART/DR 00:00:33 10.0.3.202 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.8 1 INIT/DROTHER 00:00:33 10.0.3.156 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.129 1 INIT/DROTHER 00:00:33 10.0.3.137 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.193 1 DOWN 00:00:33 10.0.3.75 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.230 1 DOWN 00:00:33 10.0.2.13 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.172 1 INIT/DROTHER 00:00:33 10.0.1.215 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.51 1 EXSTART/DR 00:00:33 10.0.3.210 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.132 1 LOADING/DR 00:00:33 10.0.1.123 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.1.80 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.53 1 EXSTART/DR 00:00:33 10.0.3.251 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.0.233) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.233\nAdvertising Router: 10.0.0.233\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.77 1 EXSTART/DR 00:00:33 10.0.1.220 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.2.229) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.229\nAdvertising Router: 10.0.2.229\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.140 1 2-WAY/DROTHER 00:00:33 10.0.2.220 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.97 1 DOWN 00:00:33 10.0.2.76 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.49 1 DOWN 00:00:33 10.0.1.208 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.146 1 INIT/DROTHER 00:00:33 10.0.2.135 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.133 1 EXSTART/DR 00:00:33 10.0.2.217 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.154 1 EXSTART/DR 00:00:33 10.0.3.97 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.28 1 EXCHANGE/DR 00:00:33 10.0.3.110 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.0.197) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.197\nAdvertising Router: 10.0.0.197\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.196 1 LOADING/DR 00:00:33 10.0.2.94 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.2.215 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.134 1 DOWN 00:00:33 10.0.2.49 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.49 1 EXCHANGE/DR 00:00:33 10.0.3.60 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.2.48) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.48\nAdvertising Router: 10.0.2.48\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.82 1 DOWN 00:00:00 10.0.2.60 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.179 1 LOADING/DR 00:00:33 10.0.2.76 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.1.39 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.230 1 DOWN 00:00:33 10.0.2.143 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.73 1 DOWN 00:00:33 10.0.3.47 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.168 1 LOADING/DR 00:00:33 10.0.1.146 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.2.103 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.90 1 DOWN 00:00:00 10.0.1.21 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.149 1 2-WAY/DROTHER 00:00:33 10.0.1.119 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.88 1 EXSTART/DR 00:00:33 10.0.1.102 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.4 1 LOADING/DR 00:00:33 10.0.2.214 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.3.120 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.18 1 LOADING/DR 00:00:33 10.0.1.155 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.3.187 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.109 1 LOADING/DR 00:00:33 10.0.3.24 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.1.239 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.10 1 EXSTART/DR 00:00:33 10.0.3.17 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.155 1 EXCHANGE/DR 00:00:33 10.0.2.72 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.1.174) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.174\nAdvertising Router: 10.0.1.174\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.167 1 INIT/DROTHER 00:00:33 10.0.3.165 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.124 1 INIT/DROTHER 00:00:33 10.0.1.204 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.155 1 INIT/DROTHER 00:00:33 10.0.2.59 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.195 1 DOWN 00:00:33 10.0.1.13 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.74 1 DOWN 00:00:00 10.0.2.14 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.3.2) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.2\nAdvertising Router: 10.0.3.2\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.4 1 INIT/DROTHER 00:00:33 10.0.1.240 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.253 1 EXSTART/DR 00:00:33 10.0.3.49 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.106 1 EXSTART/DR 00:00:33 10.0.2.56 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.157 1 EXSTART/DR 00:00:33 10.0.3.60 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.3.236) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.236\nAdvertising Router: 10.0.3.236\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.164 1 LOADING/DR 00:00:33 10.0.2.28 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.3.59 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.134 1 DOWN 00:00:00 10.0.1.224 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.99 1 INIT/DROTHER 00:00:33 10.0.1.75 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.54 1 LOADING/DR 00:00:33 10.0.1.51 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.3.22 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.165 1 INIT/DROTHER 00:00:33 10.0.3.62 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.253 1 DOWN 00:00:33 10.0.3.46 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.122 1 DOWN 00:00:00 10.0.3.142 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.89 1 INIT/DROTHER 00:00:33 10.0.1.90 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.29 1 2-WAY/DROTHER 00:00:33 10.0.2.228 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.221 1 LOADING/DR 00:00:33 10.0.1.140 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.0.60 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.4 1 DOWN 00:00:33 10.0.3.14 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.230 1 INIT/DROTHER 00:00:33 10.0.1.84 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.172 1 2-WAY/DROTHER 00:00:33 10.0.1.249 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.2.178) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.178\nAdvertising Router: 10.0.2.178\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.16 1 LOADING/DR 00:00:33 10.0.1.252 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.0.157 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.210 1 2-WAY/DROTHER 00:00:33 10.0.2.22 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.117 1 DOWN 00:00:00 10.0.1.150 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.143 1 EXSTART/DR 00:00:33 10.0.1.147 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.190 1 DOWN 00:00:00 10.0.2.201 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.71 1 EXSTART/DR 00:00:33 10.0.3.78 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.175 1 EXCHANGE/DR 00:00:33 10.0.1.100 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.3.12) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.12\nAdvertising Router: 10.0.3.12\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.108 1 2-WAY/DROTHER 00:00:33 10.0.2.149 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.88 1 DOWN 00:00:00 10.0.1.249 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.80 1 EXSTART/DR 00:00:33 10.0.2.101 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.83 1 INIT/DROTHER 00:00:33 10.0.1.21 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.173 1 INIT/DROTHER 00:00:33 10.0.2.119 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.43 1 DOWN 00:00:00 10.0.3.197 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.132 1 INIT/DROTHER 00:00:33 10.0.1.197 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.182 1 LOADING/DR 00:00:33 10.0.3.213 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.2.160 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.100 1 DOWN 00:00:33 10.0.1.129 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.43 1 DOWN 00:00:33 10.0.2.152 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.211 1 INIT/DROTHER 00:00:33 10.0.2.145 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.47 1 2-WAY/DROTHER 00:00:33 10.0.1.225 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.98 1 EXSTART/DR 00:00:33 10.0.1.185 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.164 1 EXCHANGE/DR 00:00:33 10.0.2.178 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.3.179) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.179\nAdvertising Router: 10.0.3.179\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.123 1 DOWN 00:00:00 10.0.3.31 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.249 1 LOADING/DR 00:00:33 10.0.2.208 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.2.212 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.82 1 INIT/DROTHER 00:00:33 10.0.2.118 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.2.139) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.139\nAdvertising Router: 10.0.2.139\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.183 1 EXSTART/DR 00:00:33 10.0.2.47 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.2.131) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.131\nAdvertising Router: 10.0.2.131\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.110 1 2-WAY/DROTHER 00:00:33 10.0.1.45 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.2.83) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.83\nAdvertising Router: 10.0.2.83\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.1.193) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.193\nAdvertising Router: 10.0.1.193\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.6 1 LOADING/DR 00:00:33 10.0.2.48 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.3.219 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.31 1 2-WAY/DROTHER 00:00:33 10.0.3.226 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.0.186) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.186\nAdvertising Router: 10.0.0.186\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.107 1 2-WAY/DROTHER 00:00:33 10.0.1.171 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.131 1 EXCHANGE/DR 00:00:33 10.0.2.129 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.0.139) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.139\nAdvertising Router: 10.0.0.139\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.9 1 EXSTART/DR 00:00:33 10.0.2.214 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.28 1 LOADING/DR 00:00:33 10.0.1.41 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.1.168 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.236 1 2-WAY/DROTHER 00:00:33 10.0.3.160 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.171 1 DOWN 00:00:33 10.0.2.102 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.154 1 INIT/DROTHER 00:00:33 10.0.1.173 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.67 1 LOADING/DR 00:00:33 10.0.1.28 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.3.152 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.4 1 EXSTART/DR 00:00:33 10.0.2.229 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.227 1 2-WAY/DROTHER 00:00:33 10.0.2.94 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.6 1 EXCHANGE/DR 00:00:33 10.0.3.39 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.0.158) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.158\nAdvertising Router: 10.0.0.158\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.18 1 INIT/DROTHER 00:00:33 10.0.2.95 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.250 1 EXCHANGE/DR 00:00:33 10.0.2.36 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.0.242) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.242\nAdvertising Router: 10.0.0.242\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.115 1 DOWN 00:00:00 10.0.3.187 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.202 1 INIT/DROTHER 00:00:33 10.0.1.168 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.0.73) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.73\nAdvertising Router: 10.0.0.73\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.162 1 LOADING/DR 00:00:33 10.0.1.25 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.3.109 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.195 1 2-WAY/DROTHER 00:00:33 10.0.1.164 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.130 1 DOWN 00:00:33 10.0.2.160 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.27 1 EXSTART/DR 00:00:33 10.0.2.213 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.152 1 EXSTART/DR 00:00:33 10.0.1.238 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.81 1 DOWN 00:00:00 10.0.3.211 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.47 1 EXSTART/DR 00:00:33 10.0.3.164 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.121 1 DOWN 00:00:00 10.0.1.173 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.217 1 EXSTART/DR 00:00:33 10.0.1.235 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.16 1 DOWN 00:00:00 10.0.2.209 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.171 1 LOADING/DR 00:00:33 10.0.3.32 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.2.128 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.100 1 DOWN 00:00:33 10.0.2.28 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.155 1 DOWN 00:00:33 10.0.3.46 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.117 1 EXSTART/DR 00:00:33 10.0.2.190 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.123 1 DOWN 00:00:33 10.0.1.184 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.202 1 EXCHANGE/DR 00:00:33 10.0.2.44 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.0.252) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.252\nAdvertising Router: 10.0.0.252\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.1 1 LOADING/DR 00:00:33 10.0.1.18 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.0.116 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.3.6) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.6\nAdvertising Router: 10.0.3.6\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.22 1 DOWN 00:00:33 10.0.2.5 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.139 1 DOWN 00:00:33 10.0.3.78 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.159 1 2-WAY/DROTHER 00:00:33 10.0.1.5 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.173 1 INIT/DROTHER 00:00:33 10.0.3.25 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.85 1 EXSTART/DR 00:00:33 10.0.2.20 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.184 1 DOWN 00:00:00 10.0.1.81 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.12 1 EXCHANGE/DR 00:00:33 10.0.2.237 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.2.13) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.13\nAdvertising Router: 10.0.2.13\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.38 1 DOWN 00:00:00 10.0.3.56 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.198 1 EXCHANGE/DR 00:00:33 10.0.2.55 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.3.31) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.31\nAdvertising Router: 10.0.3.31\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.0.228) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.228\nAdvertising Router: 10.0.0.228\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.187 1 DOWN 00:00:00 10.0.3.108 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.188 1 2-WAY/DROTHER 00:00:33 10.0.1.30 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.79 1 2-WAY/DROTHER 00:00:33 10.0.2.191 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.70 1 DOWN 00:00:33 10.0.2.182 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.1.80) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.80\nAdvertising Router: 10.0.1.80\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.129 1 EXSTART/DR 00:00:33 10.0.3.93 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.156 1 INIT/DROTHER 00:00:33 10.0.2.139 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.42 1 EXCHANGE/DR 00:00:33 10.0.2.158 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.1.46) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.46\nAdvertising Router: 10.0.1.46\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.157 1 INIT/DROTHER 00:00:33 10.0.2.54 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.107 1 2-WAY/DROTHER 00:00:33 10.0.2.226 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.154 1 INIT/DROTHER 00:00:33 10.0.1.34 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.3.230) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.230\nAdvertising Router: 10.0.3.230\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.40 1 2-WAY/DROTHER 00:00:33 10.0.2.176 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.17 1 EXSTART/DR 00:00:33 10.0.2.176 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.220 1 EXSTART/DR 00:00:33 10.0.3.113 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.239 1 EXCHANGE/DR 00:00:33 10.0.2.150 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.0.15) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.15\nAdvertising Router: 10.0.0.15\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.197 1 LOADING/DR 00:00:33 10.0.2.15 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.2.219 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.145 1 2-WAY/DROTHER 00:00:33 10.0.1.175 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.170 1 LOADING/DR 00:00:33 10.0.2.41 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.2.248 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.29 1 EXSTART/DR 00:00:33 10.0.2.171 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.250 1 2-WAY/DROTHER 00:00:33 10.0.2.127 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.0.189) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.189\nAdvertising Router: 10.0.0.189\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.210 1 EXSTART/DR 00:00:33 10.0.1.113 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.0.109) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.109\nAdvertising Router: 10.0.0.109\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.21 1 INIT/DROTHER 00:00:33 10.0.2.47 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.27 1 2-WAY/DROTHER 00:00:33 10.0.3.66 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.138 1 EXSTART/DR 00:00:33 10.0.2.159 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.204 1 LOADING/DR 00:00:33 10.0.1.170 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.1.215 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.174 1 EXSTART/DR 00:00:33 10.0.3.252 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.201 1 INIT/DROTHER 00:00:33 10.0.2.57 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.115 1 LOADING/DR 00:00:33 10.0.1.121 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.2.239 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.152 1 INIT/DROTHER 00:00:33 10.0.1.246 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.108 1 DOWN 00:00:00 10.0.2.20 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.199 1 EXCHANGE/DR 00:00:33 10.0.3.73 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.1.155) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.155\nAdvertising Router: 10.0.1.155\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.228 1 EXSTART/DR 00:00:33 10.0.2.164 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.138 1 2-WAY/DROTHER 00:00:33 10.0.3.135 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.2 1 LOADING/DR 00:00:33 10.0.1.57 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.1.87 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.181 1 EXCHANGE/DR 00:00:33 10.0.3.224 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.2.204) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.204\nAdvertising Router: 10.0.2.204\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.81 1 EXSTART/DR 00:00:33 10.0.2.101 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.21 1 DOWN 00:00:00 10.0.3.195 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.122 1 DOWN 00:00:33 10.0.1.25 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.235 1 EXCHANGE/DR 00:00:33 10.0.1.107 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.1.162) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.162\nAdvertising Router: 10.0.1.162\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.127 1 INIT/DROTHER 00:00:33 10.0.3.109 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.1.129) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.129\nAdvertising Router: 10.0.1.129\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.36 1 DOWN 00:00:33 10.0.1.167 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.139 1 INIT/DROTHER 00:00:33 10.0.2.241 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.207 1 INIT/DROTHER 00:00:33 10.0.3.201 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.16 1 INIT/DROTHER 00:00:33 10.0.1.224 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.1.89) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.89\nAdvertising Router: 10.0.1.89\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.16 1 INIT/DROTHER 00:00:33 10.0.3.155 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.159 1 DOWN 00:00:33 10.0.3.246 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.144 1 DOWN 00:00:33 10.0.2.52 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.116 1 INIT/DROTHER 00:00:33 10.0.1.4 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.1.67) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.67\nAdvertising Router: 10.0.1.67\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.81 1 EXSTART/DR 00:00:33 10.0.2.138 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.175 1 2-WAY/DROTHER 00:00:33 10.0.2.6 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.144 1 INIT/DROTHER 00:00:33 10.0.2.57 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.139 1 EXCHANGE/DR 00:00:33 10.0.2.4 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.0.128) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.128\nAdvertising Router: 10.0.0.128\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.20 1 LOADING/DR 00:00:33 10.0.3.250 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.0.20 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.235 1 DOWN 00:00:00 10.0.2.58 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.40 1 INIT/DROTHER 00:00:33 10.0.2.196 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.44 1 INIT/DROTHER 00:00:33 10.0.2.100 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.68 1 2-WAY/DROTHER 00:00:33 10.0.1.204 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.2.27) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.27\nAdvertising Router: 10.0.2.27\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.91 1 INIT/DROTHER 00:00:33 10.0.3.13 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.121 1 DOWN 00:00:33 10.0.1.190 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.207 1 EXSTART/DR 00:00:33 10.0.1.128 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.124 1 EXSTART/DR 00:00:33 10.0.2.131 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.3 1 EXCHANGE/DR 00:00:33 10.0.3.96 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.0.170) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.170\nAdvertising Router: 10.0.0.170\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.179 1 EXCHANGE/DR 00:00:33 10.0.2.219 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.1.98) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.98\nAdvertising Router: 10.0.1.98\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.28 1 EXSTART/DR 00:00:33 10.0.2.235 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.140 1 EXCHANGE/DR 00:00:33 10.0.2.26 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.1.208) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.208\nAdvertising Router: 10.0.1.208\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.2 1 2-WAY/DROTHER 00:00:33 10.0.1.32 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.2.224) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.224\nAdvertising Router: 10.0.2.224\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.6 1 DOWN 00:00:33 10.0.2.82 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.199 1 INIT/DROTHER 00:00:33 10.0.2.42 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.143 1 INIT/DROTHER 00:00:33 10.0.2.238 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.136 1 DOWN 00:00:33 10.0.1.210 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.23 1 INIT/DROTHER 00:00:33 10.0.2.124 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.113 1 2-WAY/DROTHER 00:00:33 10.0.1.160 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.2.69) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.69\nAdvertising Router: 10.0.2.69\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.50 1 EXCHANGE/DR 00:00:33 10.0.3.242 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.3.53) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.53\nAdvertising Router: 10.0.3.53\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.15 1 INIT/DROTHER 00:00:33 10.0.2.114 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.111 1 EXCHANGE/DR 00:00:33 10.0.1.30 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.0.5) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.5\nAdvertising Router: 10.0.0.5\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.195 1 EXSTART/DR 00:00:33 10.0.3.227 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.131 1 DOWN 00:00:33 10.0.2.67 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.173 1 INIT/DROTHER 00:00:33 10.0.1.236 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.91 1 INIT/DROTHER 00:00:33 10.0.2.31 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.127 1 DOWN 00:00:00 10.0.2.133 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.130 1 EXSTART/DR 00:00:33 10.0.2.194 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.20 1 2-WAY/DROTHER 00:00:33 10.0.3.17 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.35 1 EXSTART/DR 00:00:33 10.0.1.147 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.126 1 2-WAY/DROTHER 00:00:33 10.0.2.209 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.244 1 LOADING/DR 00:00:33 10.0.1.191 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.2.186 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.201 1 INIT/DROTHER 00:00:33 10.0.1.62 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.85 1 EXSTART/DR 00:00:33 10.0.1.86 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.248 1 INIT/DROTHER 00:00:33 10.0.3.71 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.108 1 EXCHANGE/DR 00:00:33 10.0.3.64 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.2.249) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.249\nAdvertising Router: 10.0.2.249\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.77 1 LOADING/DR 00:00:33 10.0.3.221 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.3.94 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.57 1 EXSTART/DR 00:00:33 10.0.3.124 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.102 1 DOWN 00:00:33 10.0.2.10 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "critical", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.109 1 DOWN 00:00:00 10.0.2.19 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.24 1 LOADING/DR 00:00:33 10.0.1.57 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.0.79 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.79 1 INIT/DROTHER 00:00:33 10.0.3.98 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.211 1 INIT/DROTHER 00:00:33 10.0.1.57 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.99 1 EXSTART/DR 00:00:33 10.0.2.231 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.35 1 DOWN 00:00:33 10.0.3.237 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.31 1 EXCHANGE/DR 00:00:33 10.0.2.99 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.3.183) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.183\nAdvertising Router: 10.0.3.183\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.216 1 EXSTART/DR 00:00:33 10.0.3.199 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.29 1 2-WAY/DROTHER 00:00:33 10.0.1.186 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.254 1 EXCHANGE/DR 00:00:33 10.0.3.219 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.1.132) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.132\nAdvertising Router: 10.0.1.132\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.0.125) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.125\nAdvertising Router: 10.0.0.125\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.68 1 2-WAY/DROTHER 00:00:33 10.0.2.167 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.98 1 DOWN 00:00:33 10.0.3.151 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.192 1 INIT/DROTHER 00:00:33 10.0.3.64 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.108 1 DOWN 00:00:33 10.0.3.26 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.251 1 2-WAY/DROTHER 00:00:33 10.0.3.17 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.146 1 INIT/DROTHER 00:00:33 10.0.1.25 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.99 1 LOADING/DR 00:00:33 10.0.1.3 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.0.54 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.88 1 INIT/DROTHER 00:00:33 10.0.2.36 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.3.173) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.173\nAdvertising Router: 10.0.3.173\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.203 1 EXCHANGE/DR 00:00:33 10.0.3.186 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.1.178) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.178\nAdvertising Router: 10.0.1.178\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.138 1 LOADING/DR 00:00:33 10.0.2.233 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.0.100 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.84 1 EXCHANGE/DR 00:00:33 10.0.3.215 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.1.54) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.54\nAdvertising Router: 10.0.1.54\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.62 1 INIT/DROTHER 00:00:33 10.0.3.141 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.21 1 INIT/DROTHER 00:00:33 10.0.3.111 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.210 1 INIT/DROTHER 00:00:33 10.0.3.48 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.216 1 DOWN 00:00:00 10.0.1.104 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.137 1 LOADING/DR 00:00:33 10.0.3.192 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.2.23 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.1.136) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.136\nAdvertising Router: 10.0.1.136\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.249 1 DOWN 00:00:33 10.0.1.193 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.139 1 INIT/DROTHER 00:00:33 10.0.1.211 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.25 1 DOWN 00:00:33 10.0.2.117 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.27 1 2-WAY/DROTHER 00:00:33 10.0.1.55 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "medium", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.168 1 2-WAY/DROTHER 00:00:33 10.0.3.144 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.198 1 2-WAY/DROTHER 00:00:33 10.0.2.92 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.2.117) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.117\nAdvertising Router: 10.0.2.117\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.224 1 DOWN 00:00:00 10.0.3.134 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.32 1 EXCHANGE/DR 00:00:33 10.0.3.165 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.1.141) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.141\nAdvertising Router: 10.0.1.141\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.3.21) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.21\nAdvertising Router: 10.0.3.21\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.163 1 EXSTART/DR 00:00:33 10.0.2.235 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.133 1 EXCHANGE/DR 00:00:33 10.0.2.53 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.3.164) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.164\nAdvertising Router: 10.0.3.164\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.108 1 INIT/DROTHER 00:00:33 10.0.2.133 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.1.38) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.38\nAdvertising Router: 10.0.1.38\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.62 1 DOWN 00:00:00 10.0.3.68 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.219 1 DOWN 00:00:33 10.0.2.163 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.53 1 EXSTART/DR 00:00:33 10.0.1.127 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.25 1 EXSTART/DR 00:00:33 10.0.3.203 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.27 1 EXCHANGE/DR 00:00:33 10.0.1.42 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.1.216) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.216\nAdvertising Router: 10.0.1.216\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.35 1 2-WAY/DROTHER 00:00:33 10.0.2.128 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.2.244) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.244\nAdvertising Router: 10.0.2.244\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.99 1 DOWN 00:00:33 10.0.3.43 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.145 1 EXSTART/DR 00:00:33 10.0.3.215 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.20 1 DOWN 00:00:33 10.0.1.80 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.227 1 DOWN 00:00:00 10.0.1.212 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.65 1 INIT/DROTHER 00:00:33 10.0.2.170 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.145 1 EXSTART/DR 00:00:33 10.0.3.168 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.2.116) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.116\nAdvertising Router: 10.0.2.116\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.0.241) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.241\nAdvertising Router: 10.0.0.241\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.100 1 LOADING/DR 00:00:33 10.0.3.252 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.1.82 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.249 1 INIT/DROTHER 00:00:33 10.0.1.223 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.32 1 EXSTART/DR 00:00:33 10.0.2.22 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.71 1 DOWN 00:00:33 10.0.2.155 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.62 1 DOWN 00:00:00 10.0.1.208 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.242 1 DOWN 00:00:00 10.0.1.169 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.104 1 EXCHANGE/DR 00:00:33 10.0.2.237 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.2.245) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.245\nAdvertising Router: 10.0.2.245\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.86 1 LOADING/DR 00:00:33 10.0.1.180 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.3.96 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.99 1 INIT/DROTHER 00:00:33 10.0.2.169 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.14 1 INIT/DROTHER 00:00:33 10.0.3.132 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.171 1 2-WAY/DROTHER 00:00:33 10.0.3.205 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.46 1 EXCHANGE/DR 00:00:33 10.0.1.121 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.2.30) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.30\nAdvertising Router: 10.0.2.30\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.74 1 EXSTART/DR 00:00:33 10.0.2.25 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.2.110) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.110\nAdvertising Router: 10.0.2.110\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.54 1 LOADING/DR 00:00:33 10.0.1.24 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.0.129 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.223 1 EXCHANGE/DR 00:00:33 10.0.3.242 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.2.195) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.195\nAdvertising Router: 10.0.2.195\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.142 1 INIT/DROTHER 00:00:33 10.0.1.138 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.171 1 EXSTART/DR 00:00:33 10.0.1.127 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.202 1 INIT/DROTHER 00:00:33 10.0.2.231 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.37 1 EXSTART/DR 00:00:33 10.0.3.4 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.195 1 DOWN 00:00:33 10.0.3.141 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.4 1 INIT/DROTHER 00:00:33 10.0.2.252 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.205 1 LOADING/DR 00:00:33 10.0.1.36 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.2.192 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.79 1 EXSTART/DR 00:00:33 10.0.3.88 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.18 1 INIT/DROTHER 00:00:33 10.0.2.227 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.83 1 LOADING/DR 00:00:33 10.0.1.207 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.0.125 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.135 1 EXSTART/DR 00:00:33 10.0.1.74 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.115 1 EXSTART/DR 00:00:33 10.0.3.54 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.139 1 EXSTART/DR 00:00:33 10.0.2.18 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.128 1 INIT/DROTHER 00:00:33 10.0.2.214 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.12 1 DOWN 00:00:33 10.0.2.2 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.205 1 EXCHANGE/DR 00:00:33 10.0.2.84 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.3.106) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.106\nAdvertising Router: 10.0.3.106\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.94 1 EXCHANGE/DR 00:00:33 10.0.2.239 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.3.194) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.194\nAdvertising Router: 10.0.3.194\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.223 1 INIT/DROTHER 00:00:33 10.0.2.66 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.183 1 INIT/DROTHER 00:00:33 10.0.2.33 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.11 1 EXSTART/DR 00:00:33 10.0.2.203 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.228 1 EXCHANGE/DR 00:00:33 10.0.2.86 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.0.213) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.213\nAdvertising Router: 10.0.0.213\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.2 1 INIT/DROTHER 00:00:33 10.0.3.150 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.173 1 INIT/DROTHER 00:00:33 10.0.2.130 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.210 1 DOWN 00:00:33 10.0.2.130 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.5 1 EXSTART/DR 00:00:33 10.0.3.32 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.3.84) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.84\nAdvertising Router: 10.0.3.84\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.131 1 LOADING/DR 00:00:33 10.0.2.163 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.3.115 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.137 1 EXCHANGE/DR 00:00:33 10.0.2.43 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.1.151) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.151\nAdvertising Router: 10.0.1.151\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.8 1 2-WAY/DROTHER 00:00:33 10.0.3.48 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.2.155) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.155\nAdvertising Router: 10.0.2.155\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.94 1 EXSTART/DR 00:00:33 10.0.2.172 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.221 1 EXSTART/DR 00:00:33 10.0.3.115 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "high", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.47 1 INIT/DROTHER 00:00:33 10.0.2.97 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "medium", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.215 1 INIT/DROTHER 00:00:33 10.0.2.211 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.141 1 INIT/DROTHER 00:00:33 10.0.3.37 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.37 1 DOWN 00:00:33 10.0.3.216 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.60 1 LOADING/DR 00:00:33 10.0.2.205 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.0.59 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.197 1 DOWN 00:00:00 10.0.2.26 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.176 1 EXSTART/DR 00:00:33 10.0.2.8 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.187 1 EXSTART/DR 00:00:33 10.0.1.73 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.241 1 DOWN 00:00:33 10.0.2.54 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.221 1 EXSTART/DR 00:00:33 10.0.1.18 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.118 1 INIT/DROTHER 00:00:33 10.0.2.159 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.13 1 EXCHANGE/DR 00:00:33 10.0.1.197 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.1.58) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.58\nAdvertising Router: 10.0.1.58\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.137 1 INIT/DROTHER 00:00:33 10.0.3.175 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.27 1 EXSTART/DR 00:00:33 10.0.3.32 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.3.95) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.95\nAdvertising Router: 10.0.3.95\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.43 1 EXCHANGE/DR 00:00:33 10.0.3.46 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.1.115) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.115\nAdvertising Router: 10.0.1.115\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.152 1 EXSTART/DR 00:00:33 10.0.1.136 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.184 1 EXSTART/DR 00:00:33 10.0.2.189 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.117 1 LOADING/DR 00:00:33 10.0.3.138 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.3.244 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "low", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.232 1 DOWN 00:00:33 10.0.3.206 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.3 1 LOADING/DR 00:00:33 10.0.2.49 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.1.133 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "medium", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.67 1 LOADING/DR 00:00:33 10.0.1.86 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.1.9 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.130 1 2-WAY/DROTHER 00:00:33 10.0.1.32 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.3.200) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.200\nAdvertising Router: 10.0.3.200\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.72 1 INIT/DROTHER 00:00:33 10.0.2.181 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "high", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.64 1 DOWN 00:00:33 10.0.3.87 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.233 1 EXSTART/DR 00:00:33 10.0.3.7 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.75 1 INIT/DROTHER 00:00:33 10.0.3.148 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.158 1 EXSTART/DR 00:00:33 10.0.3.193 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.65 1 INIT/DROTHER 00:00:33 10.0.2.21 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.190 1 DOWN 00:00:00 10.0.1.51 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.168 1 EXSTART/DR 00:00:33 10.0.2.245 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.40 1 EXSTART/DR 00:00:33 10.0.3.109 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.160 1 INIT/DROTHER 00:00:33 10.0.2.96 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.190 1 LOADING/DR 00:00:33 10.0.1.9 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.1.16 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "low", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.173 1 EXSTART/DR 00:00:33 10.0.3.151 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.107 1 LOADING/DR 00:00:33 10.0.3.62 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.2.36 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.44 1 LOADING/DR 00:00:33 10.0.3.68 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.1.37 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.2.71) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.71\nAdvertising Router: 10.0.2.71\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.226 1 INIT/DROTHER 00:00:33 10.0.1.122 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.105 1 EXSTART/DR 00:00:33 10.0.1.233 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.3.63) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.63\nAdvertising Router: 10.0.3.63\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.234 1 INIT/DROTHER 00:00:33 10.0.3.188 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.254 1 INIT/DROTHER 00:00:33 10.0.3.116 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "low", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.212 1 INIT/DROTHER 00:00:33 10.0.1.92 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.44 1 INIT/DROTHER 00:00:33 10.0.3.166 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.136 1 EXSTART/DR 00:00:33 10.0.1.233 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.16 1 INIT/DROTHER 00:00:33 10.0.3.242 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.41 1 INIT/DROTHER 00:00:33 10.0.3.83 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.138 1 INIT/DROTHER 00:00:33 10.0.1.116 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.34 1 INIT/DROTHER 00:00:33 10.0.1.191 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "low", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.117 1 2-WAY/DROTHER 00:00:33 10.0.2.213 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.246 1 EXCHANGE/DR 00:00:33 10.0.1.2 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.0.236) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.0.236\nAdvertising Router: 10.0.0.236\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.195 1 2-WAY/DROTHER 00:00:33 10.0.2.149 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.3.61) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.61\nAdvertising Router: 10.0.3.61\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.105 1 EXSTART/DR 00:00:33 10.0.1.224 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.200 1 EXSTART/DR 00:00:33 10.0.2.227 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "medium", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.34 1 DOWN 00:00:33 10.0.1.63 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "medium", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "critical", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.63 1 DOWN 00:00:33 10.0.3.123 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.235 1 INIT/DROTHER 00:00:33 10.0.1.222 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.176 1 EXSTART/DR 00:00:33 10.0.2.32 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.151 1 EXSTART/DR 00:00:33 10.0.3.130 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.127 1 INIT/DROTHER 00:00:33 10.0.3.117 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.60 1 EXSTART/DR 00:00:33 10.0.3.209 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "low", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.118 1 DOWN 00:00:00 10.0.1.129 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.158 1 DOWN 00:00:00 10.0.3.114 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.66 1 EXSTART/DR 00:00:33 10.0.2.106 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.99 1 EXSTART/DR 00:00:33 10.0.3.13 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.2.142) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.142\nAdvertising Router: 10.0.2.142\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.96 1 EXSTART/DR 00:00:33 10.0.1.244 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "low", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.54 1 EXSTART/DR 00:00:33 10.0.3.112 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.141 1 EXSTART/DR 00:00:33 10.0.2.54 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "critical", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.172 1 INIT/DROTHER 00:00:33 10.0.1.247 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.145 1 DOWN 00:00:00 10.0.3.83 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.10 1 INIT/DROTHER 00:00:33 10.0.2.214 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.50 1 INIT/DROTHER 00:00:33 10.0.1.157 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "low", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.2.121) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.121\nAdvertising Router: 10.0.2.121\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.62 1 INIT/DROTHER 00:00:33 10.0.3.177 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.164 1 LOADING/DR 00:00:33 10.0.2.57 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.2.79 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.71 1 DOWN 00:00:00 10.0.2.195 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.221 1 INIT/DROTHER 00:00:33 10.0.1.67 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.11 1 EXSTART/DR 00:00:33 10.0.1.167 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "critical", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.2.70) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.70\nAdvertising Router: 10.0.2.70\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.75 1 EXCHANGE/DR 00:00:33 10.0.1.254 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.3.165) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.165\nAdvertising Router: 10.0.3.165\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.133 1 DOWN 00:00:33 10.0.2.91 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.245 1 DOWN 00:00:00 10.0.1.25 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "critical", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.230 1 INIT/DROTHER 00:00:33 10.0.1.17 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "high", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.3.152) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.152\nAdvertising Router: 10.0.3.152\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.31 1 2-WAY/DROTHER 00:00:33 10.0.2.148 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "low", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.158 1 LOADING/DR 00:00:33 10.0.2.246 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.1.69 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "low", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.53 1 EXSTART/DR 00:00:33 10.0.2.44 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "medium", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.174 1 INIT/DROTHER 00:00:33 10.0.2.26 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.167 1 EXCHANGE/DR 00:00:33 10.0.2.146 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.1.43) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.43\nAdvertising Router: 10.0.1.43\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.7 1 INIT/DROTHER 00:00:33 10.0.3.243 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Area mismatch", "wazuh_alert": {"severity": "low", "description": "Area mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.56 1 INIT/DROTHER 00:00:33 10.0.3.76 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.4.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Mismatched area ID with neighbor (1)\n"}, "expected_output": {"diagnosis": "OSPF area mismatch between neighbors.", "root_cause": "Local interface is in Area 0, neighbor expects different area.", "recommended_fixes": ["Ensure both neighbors use the same OSPF area for the shared link.", "Adjust OSPF area configuration or network statement accordingly."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "critical", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.121 1 2-WAY/DROTHER 00:00:33 10.0.3.246 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.208 1 EXSTART/DR 00:00:33 10.0.1.196 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.89 1 EXSTART/DR 00:00:33 10.0.3.123 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "high", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.253 1 DOWN 00:00:00 10.0.1.103 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Hello/dead timer mismatch", "wazuh_alert": {"severity": "medium", "description": "Hello/dead timer mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.68 1 DOWN 00:00:00 10.0.2.69 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Neighbor hello 5, dead 20 (mismatch)\n"}, "expected_output": {"diagnosis": "OSPF adjacency failure due to hello/dead timer mismatch.", "root_cause": "Hello/dead intervals differ between neighbors.", "recommended_fixes": ["Align OSPF hello and dead timers on both routers.", "Ensure consistent interface OSPF settings across neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Stuck in INIT", "wazuh_alert": {"severity": "high", "description": "Stuck in INIT"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.225 1 INIT/DROTHER 00:00:33 10.0.2.202 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.6.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Hellos received but 2-Way not achieved\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in INIT state.", "root_cause": "Hellos received but router's own ID not seen in neighbor's hello packets.", "recommended_fixes": ["Check for unidirectional link or ACLs filtering OSPF traffic.", "Verify that both sides have correct OSPF configuration and network types."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.17 1 LOADING/DR 00:00:33 10.0.1.74 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.3.138 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "critical", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.68 1 LOADING/DR 00:00:33 10.0.3.35 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.2.199 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "low", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "low", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.74 1 EXCHANGE/DR 00:00:33 10.0.3.243 GigabitEthernet0/2\n", "show ip ospf database": " OSPF Router with ID (10.0.3.145) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.145\nAdvertising Router: 10.0.3.145\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.76 1 2-WAY/DROTHER 00:00:33 10.0.3.161 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Passive interface enabled", "wazuh_alert": {"severity": "high", "description": "Passive interface enabled"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.156 1 DOWN 00:00:33 10.0.3.221 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.3.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Passive interface enabled\n"}, "expected_output": {"diagnosis": "OSPF adjacency cannot form on passive interface.", "root_cause": "Interface configured as passive under OSPF.", "recommended_fixes": ["Remove 'passive-interface' command for this interface if adjacency is required.", "Alternatively keep passive if adjacency is not desired and adjust design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "critical", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.75 1 EXSTART/DR 00:00:33 10.0.1.235 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/0 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "medium", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.214 1 EXSTART/DR 00:00:33 10.0.1.173 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "high", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "medium", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "critical", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.102 1 EXCHANGE/DR 00:00:33 10.0.1.45 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.1.66) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.66\nAdvertising Router: 10.0.1.66\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "CORE-R1", "incident_type": "LSDB desync", "wazuh_alert": {"severity": "medium", "description": "LSDB desync"}, "show_outputs": {"show ip ospf database": " OSPF Router with ID (10.0.2.88) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.2.88\nAdvertising Router: 10.0.2.88\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf traffic": "OSPF statistics:\n Hellos sent/received 1000/1000\n DD packets sent/received 200/180\n LSAs flooded/retransmitted 300/80\n"}, "expected_output": {"diagnosis": "OSPF LSDB desynchronization detected.", "root_cause": "Frequent LSA retransmissions or flooding issues.", "recommended_fixes": ["Clear the affected OSPF neighbor to resynchronize LSDB.", "Investigate unstable links or flapping adjacencies causing LSA storms."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "medium", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.233 1 EXCHANGE/DR 00:00:33 10.0.3.197 GigabitEthernet0/0\n", "show ip ospf database": " OSPF Router with ID (10.0.1.127) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.1.127\nAdvertising Router: 10.0.1.127\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "critical", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.2.107 1 EXSTART/DR 00:00:33 10.0.2.128 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Stuck in 2-Way", "wazuh_alert": {"severity": "high", "description": "Stuck in 2-Way"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.229 1 2-WAY/DROTHER 00:00:33 10.0.2.183 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.7.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Multi-access network, neighbor stuck in 2-Way\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in 2-Way state.", "root_cause": "On multi-access networks, only DR/BDR form full adjacency.", "recommended_fixes": ["Confirm DR/BDR election is working as expected.", "If full adjacency is required, review network type or design."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.93 1 LOADING/DR 00:00:33 10.0.1.164 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.3.114 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Authentication mismatch", "wazuh_alert": {"severity": "high", "description": "Authentication mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.3.27 1 EXSTART/DR 00:00:33 10.0.2.159 GigabitEthernet0/0\n", "show ip ospf interface": "GigabitEthernet0/0 is up, line protocol is up\n Internet Address 10.0.5.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Authentication type/key mismatch with neighbor\n"}, "expected_output": {"diagnosis": "OSPF authentication mismatch prevents full adjacency.", "root_cause": "Different authentication type or key configured on neighbors.", "recommended_fixes": ["Verify OSPF authentication type (none, simple, MD5) on both sides.", "Ensure the same key/password is configured on all OSPF neighbors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "high", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.183 1 EXSTART/DR 00:00:33 10.0.1.245 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "OSPF neighbor down", "wazuh_alert": {"severity": "critical", "description": "OSPF neighbor down"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.2.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n No hellos received in last dead interval\n", "show interfaces": "GigabitEthernet0/2 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF neighbor is down; no adjacency established.", "root_cause": "No hello packets received or physical link issue.", "recommended_fixes": ["Verify physical connectivity and interface status.", "Check OSPF enablement and hello packet flow on the segment."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW2", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.253 1 LOADING/DR 00:00:33 10.0.1.237 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.1.16 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "EDGE-FW1", "incident_type": "Stuck in EXCHANGE", "wazuh_alert": {"severity": "high", "description": "Stuck in EXCHANGE"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.216 1 EXCHANGE/DR 00:00:33 10.0.1.112 GigabitEthernet0/1\n", "show ip ospf database": " OSPF Router with ID (10.0.3.9) (Process ID 1)\n\n Router Link States (Area 0)\nLS age: 1546\nLS Type: Router Links\nLink State ID: 10.0.3.9\nAdvertising Router: 10.0.3.9\nLS Seq Number: 80000A3A\nChecksum: 0x4F31\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.8.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n DD exchange issues reported\n"}, "expected_output": {"diagnosis": "OSPF neighbor stuck in EXCHANGE state.", "root_cause": "Issues during DD packet exchange; often MTU or LSA problems.", "recommended_fixes": ["Verify MTU consistency across the link.", "Clear OSPF adjacency and monitor DD exchange for errors."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "BRANCH-RTR1", "incident_type": "Missing network statement", "wazuh_alert": {"severity": "critical", "description": "Missing network statement"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n \n", "show run | section ospf": "router ospf 1\n network 10.0.10.0 0.0.0.255 area 0\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n OSPF not enabled on this interface\n"}, "expected_output": {"diagnosis": "OSPF not enabled on interface due to missing network statement.", "root_cause": "Interface subnet is not covered by any OSPF 'network' command.", "recommended_fixes": ["Add the correct network statement matching the interface subnet under OSPF.", "Confirm that OSPF is intended to run on this interface."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "Router-ID conflict", "wazuh_alert": {"severity": "high", "description": "Router-ID conflict"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.47 1 LOADING/DR 00:00:33 10.0.3.199 GigabitEthernet0/2\n", "show ip ospf interface": "GigabitEthernet0/2 is up, line protocol is up\n Internet Address 10.0.9.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n Local router-id 10.0.1.151 conflicts with neighbor\n"}, "expected_output": {"diagnosis": "Duplicate OSPF router-id causing adjacency issues.", "root_cause": "Two routers share the same OSPF router-id.", "recommended_fixes": ["Assign unique router-ids to all OSPF routers.", "Restart OSPF process on routers after changing router-id."]}} {"instruction": "Analyze the OSPF incident and propose root cause and mitigation steps.", "device": "ACCESS-SW1", "incident_type": "EXSTART MTU mismatch", "wazuh_alert": {"severity": "medium", "description": "EXSTART MTU mismatch"}, "show_outputs": {"show ip ospf neighbor": "Neighbor ID Pri State Dead Time Address Interface\n10.0.1.128 1 EXSTART/DR 00:00:33 10.0.3.6 GigabitEthernet0/1\n", "show ip ospf interface": "GigabitEthernet0/1 is up, line protocol is up\n Internet Address 10.0.1.1/24, Area 0\n MTU 1500 bytes\n Timer intervals configured, Hello 10, Dead 40\n Neighbor Count is 1, Adjacent neighbor count is 0\n MTU mismatch detected with neighbor (1400 bytes)\n", "show interfaces": "GigabitEthernet0/1 is up, line protocol is up\n Hardware is iGbE\n MTU 1500 bytes, BW 1000000 Kbit/sec\n 5 minute input rate 2048 bits/sec, 3 packets/sec\n 5 minute output rate 4096 bits/sec, 2 packets/sec\n Input errors: 0, Output errors: 0\n"}, "expected_output": {"diagnosis": "OSPF adjacency stuck in EXSTART due to MTU mismatch.", "root_cause": "Local interface MTU does not match neighbor MTU.", "recommended_fixes": ["Configure matching MTU on both sides of the link.", "Clear OSPF process or reset the adjacency after fixing MTU."]}}