{"instruction": "Wazuh detected event 'mac flapping detected' on device ACCESS-SW2 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.136.233.252", "event": "mac flapping detected", "severity": "critical"}, "requested_show": ["show mac address-table", "show mac address-table move", "show spanning-tree"]}
{"instruction": "Wazuh detected event 'blacklisted ip communication' on device CORE-R1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.244.88.151", "event": "blacklisted ip communication", "severity": "low"}, "requested_show": ["show conn address", "show access-lists", "show ip route", "show logging | include DENY"]}
{"instruction": "Wazuh detected event 'nat translation failure' on device ACCESS-SW2 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.31.194.31", "event": "nat translation failure", "severity": "critical"}, "requested_show": ["show ip nat translations", "show ip nat statistics"]}
{"instruction": "Wazuh detected event 'ntp sync lost' on device ACCESS-SW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.202.73.120", "event": "ntp sync lost", "severity": "low"}, "requested_show": ["show clock", "show ntp associations", "show ntp status"]}
{"instruction": "Wazuh detected event 'nat translation failure' on device ACCESS-SW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.234.82.223", "event": "nat translation failure", "severity": "low"}, "requested_show": ["show ip nat translations", "show ip nat statistics"]}
{"instruction": "Wazuh detected event 'acl blocking legitimate traffic' on device BRANCH-RTR1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.152.73.179", "event": "acl blocking legitimate traffic", "severity": "critical"}, "requested_show": ["show access-lists", "show logging | include DENY", "show ip interface", "show ip route"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device ACCESS-SW2 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.147.201.55", "event": "arp spoofing suspected", "severity": "critical"}, "requested_show": ["show mac address-table", "show ip traffic", "show arp", "show ip verify source"]}
{"instruction": "Wazuh detected event 'mac flapping detected' on device EDGE-FW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.30.116.162", "event": "mac flapping detected", "severity": "high"}, "requested_show": ["show mac address-table", "show mac address-table move", "show spanning-tree"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device BRANCH-RTR1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.124.18.219", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show ip ospf interface", "show ip ospf neighbor", "show ip ospf database", "show interfaces"]}
{"instruction": "Wazuh detected event 'port scan detected' on device ACCESS-SW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.202.0.68", "event": "port scan detected", "severity": "low"}, "requested_show": ["show conn", "show firewall", "show logging | include DENY", "show access-lists"]}
{"instruction": "Wazuh detected event 'firewall deny excessive' on device EDGE-FW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.175.41.19", "event": "firewall deny excessive", "severity": "critical"}, "requested_show": ["show conn", "show access-lists", "show firewall"]}
{"instruction": "Wazuh detected event 'snmp brute-force' on device ACCESS-SW2 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.18.224.79", "event": "snmp brute-force", "severity": "medium"}, "requested_show": ["show snmp user", "show logging | include SNMP", "show snmp group"]}
{"instruction": "Wazuh detected event 'memory leak suspected' on device BRANCH-RTR1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.82.169.93", "event": "memory leak suspected", "severity": "low"}, "requested_show": ["show processes memory sorted", "show memory statistics"]}
{"instruction": "Wazuh detected event 'vrf route leak' on device CORE-R1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.176.127.102", "event": "vrf route leak", "severity": "low"}, "requested_show": ["show ip route vrf", "show ip vrf"]}
{"instruction": "Wazuh detected event 'static route mismatch' on device EDGE-FW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.76.130.156", "event": "static route mismatch", "severity": "high"}, "requested_show": ["show running-config | include ip route", "show ip route static"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device BRANCH-RTR1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.51.95.173", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show ip ospf interface", "show interfaces", "show ip ospf neighbor", "show ip ospf database"]}
{"instruction": "Wazuh detected event 'packet loss detected' on device ACCESS-SW2 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.152.18.42", "event": "packet loss detected", "severity": "medium"}, "requested_show": ["show interfaces", "show interfaces counters errors"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device EDGE-FW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.116.144.152", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show ip traffic", "show arp", "show mac address-table", "show ip verify source"]}
{"instruction": "Wazuh detected event 'lldp neighbor mismatch' on device ACCESS-SW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.186.105.62", "event": "lldp neighbor mismatch", "severity": "medium"}, "requested_show": ["show lldp neighbors detail", "show lldp neighbors"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device EDGE-FW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.12.157.174", "event": "failed login attempts", "severity": "high"}, "requested_show": ["show logging | include LOGIN", "show ip ssh", "show users"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device EDGE-FW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.129.152.211", "event": "high cpu usage", "severity": "low"}, "requested_show": ["show processes cpu sorted", "show platform resources", "show memory statistics"]}
{"instruction": "Wazuh detected event 'broadcast storm detected' on device CORE-R1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.162.173.63", "event": "broadcast storm detected", "severity": "low"}, "requested_show": ["show ip traffic", "show interfaces counters", "show mac address-table"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device ACCESS-SW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.50.12.249", "event": "failed login attempts", "severity": "critical"}, "requested_show": ["show logging | include LOGIN", "show ip ssh", "show users"]}
{"instruction": "Wazuh detected event 'blacklisted ip communication' on device CORE-R1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.84.177.200", "event": "blacklisted ip communication", "severity": "low"}, "requested_show": ["show access-lists", "show logging | include DENY", "show ip route", "show conn address"]}
{"instruction": "Wazuh detected event 'ospf lsa flood' on device ACCESS-SW2 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.66.223.154", "event": "ospf lsa flood", "severity": "medium"}, "requested_show": ["show ip ospf", "show ip ospf database"]}
{"instruction": "Wazuh detected event 'memory leak suspected' on device EDGE-FW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.199.226.81", "event": "memory leak suspected", "severity": "medium"}, "requested_show": ["show processes memory sorted", "show memory statistics"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device BRANCH-RTR1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.73.60.189", "event": "dns exfiltration suspected", "severity": "critical"}, "requested_show": ["show ip dns view", "show ip traffic", "show logging | include DNS"]}
{"instruction": "Wazuh detected event 'bgp session flap' on device EDGE-FW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.31.168.155", "event": "bgp session flap", "severity": "low"}, "requested_show": ["show ip bgp summary", "show ip bgp neighbors", "show ip route", "show logging | include BGP"]}
{"instruction": "Wazuh detected event 'link duplex mismatch' on device ACCESS-SW2 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.39.169.115", "event": "link duplex mismatch", "severity": "low"}, "requested_show": ["show controllers", "show interfaces"]}
{"instruction": "Wazuh detected event 'tcp retransmissions high' on device ACCESS-SW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.248.125.102", "event": "tcp retransmissions high", "severity": "high"}, "requested_show": ["show interfaces", "show ip tcp statistics", "show ip traffic"]}
{"instruction": "Wazuh detected event 'blacklisted ip communication' on device EDGE-FW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.250.37.224", "event": "blacklisted ip communication", "severity": "low"}, "requested_show": ["show access-lists", "show conn address", "show logging | include DENY", "show ip route"]}
{"instruction": "Wazuh detected event 'memory leak suspected' on device CORE-R1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.124.157.44", "event": "memory leak suspected", "severity": "critical"}, "requested_show": ["show memory statistics", "show processes memory sorted"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device BRANCH-RTR1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.212.51.151", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show ip ospf interface", "show interfaces", "show ip ospf neighbor", "show ip ospf database"]}
{"instruction": "Wazuh detected event 'tcp retransmissions high' on device ACCESS-SW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.32.194.85", "event": "tcp retransmissions high", "severity": "critical"}, "requested_show": ["show ip traffic", "show interfaces", "show ip tcp statistics"]}
{"instruction": "Wazuh detected event 'port scan detected' on device CORE-R1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.186.154.183", "event": "port scan detected", "severity": "critical"}, "requested_show": ["show conn", "show firewall", "show ip traffic", "show access-lists"]}
{"instruction": "Wazuh detected event 'snmp brute-force' on device BRANCH-RTR1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.154.244.166", "event": "snmp brute-force", "severity": "critical"}, "requested_show": ["show snmp group", "show logging | include SNMP", "show snmp user"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device ACCESS-SW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.16.29.241", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show arp", "show ip traffic", "show ip verify source", "show mac address-table"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device EDGE-FW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.225.129.35", "event": "high cpu usage", "severity": "critical"}, "requested_show": ["show processes cpu sorted", "show platform resources", "show memory statistics"]}
{"instruction": "Wazuh detected event 'snmp brute-force' on device ACCESS-SW2 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.201.208.163", "event": "snmp brute-force", "severity": "critical"}, "requested_show": ["show logging | include SNMP", "show snmp user", "show snmp group"]}
{"instruction": "Wazuh detected event 'syslog flood detected' on device ACCESS-SW2 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.249.145.161", "event": "syslog flood detected", "severity": "medium"}, "requested_show": ["show logging", "show ip traffic", "show interfaces counters"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device EDGE-FW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.161.55.20", "event": "dns exfiltration suspected", "severity": "high"}, "requested_show": ["show logging | include DNS", "show ip dns view", "show ip traffic"]}
{"instruction": "Wazuh detected event 'interface flapping' on device BRANCH-RTR1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.80.202.242", "event": "interface flapping", "severity": "critical"}, "requested_show": ["show interfaces", "show interfaces status", "show logging | include LINK"]}
{"instruction": "Wazuh detected event 'bgp session flap' on device CORE-R1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.226.168.192", "event": "bgp session flap", "severity": "low"}, "requested_show": ["show ip bgp neighbors", "show ip bgp summary", "show logging | include BGP", "show ip route"]}
{"instruction": "Wazuh detected event 'blacklisted ip communication' on device ACCESS-SW2 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.153.7.73", "event": "blacklisted ip communication", "severity": "low"}, "requested_show": ["show conn address", "show ip route", "show access-lists", "show logging | include DENY"]}
{"instruction": "Wazuh detected event 'vlan mismatch detected' on device ACCESS-SW2 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.144.51.165", "event": "vlan mismatch detected", "severity": "critical"}, "requested_show": ["show interfaces trunk", "show vlan brief"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device ACCESS-SW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.106.230.132", "event": "failed login attempts", "severity": "medium"}, "requested_show": ["show ip ssh", "show users", "show logging | include LOGIN"]}
{"instruction": "Wazuh detected event 'mac flapping detected' on device CORE-R1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.63.252.198", "event": "mac flapping detected", "severity": "critical"}, "requested_show": ["show spanning-tree", "show mac address-table", "show mac address-table move"]}
{"instruction": "Wazuh detected event 'memory leak suspected' on device ACCESS-SW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.82.231.53", "event": "memory leak suspected", "severity": "critical"}, "requested_show": ["show memory statistics", "show processes memory sorted"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device ACCESS-SW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.72.9.68", "event": "arp spoofing suspected", "severity": "low"}, "requested_show": ["show mac address-table", "show arp", "show ip verify source", "show ip traffic"]}
{"instruction": "Wazuh detected event 'cdp rogue device' on device ACCESS-SW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.120.249.38", "event": "cdp rogue device", "severity": "medium"}, "requested_show": ["show cdp neighbors detail", "show cdp neighbors"]}
{"instruction": "Wazuh detected event 'mtu mismatch' on device BRANCH-RTR1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.30.82.126", "event": "mtu mismatch", "severity": "critical"}, "requested_show": ["show interfaces", "show ip ospf interface"]}
{"instruction": "Wazuh detected event 'mtu mismatch' on device CORE-R1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.128.170.62", "event": "mtu mismatch", "severity": "high"}, "requested_show": ["show ip ospf interface", "show interfaces"]}
{"instruction": "Wazuh detected event 'cdp rogue device' on device CORE-R1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.219.9.232", "event": "cdp rogue device", "severity": "high"}, "requested_show": ["show cdp neighbors detail", "show cdp neighbors"]}
{"instruction": "Wazuh detected event 'firewall deny excessive' on device EDGE-FW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.227.179.157", "event": "firewall deny excessive", "severity": "critical"}, "requested_show": ["show firewall", "show access-lists", "show conn"]}
{"instruction": "Wazuh detected event 'link duplex mismatch' on device EDGE-FW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.247.18.118", "event": "link duplex mismatch", "severity": "medium"}, "requested_show": ["show controllers", "show interfaces"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device EDGE-FW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.143.36.34", "event": "dns exfiltration suspected", "severity": "critical"}, "requested_show": ["show ip traffic", "show ip dns view", "show logging | include DNS"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device BRANCH-RTR1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.249.213.98", "event": "dns exfiltration suspected", "severity": "high"}, "requested_show": ["show ip dns view", "show logging | include DNS", "show ip traffic"]}
{"instruction": "Wazuh detected event 'static route mismatch' on device ACCESS-SW2 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.71.234.168", "event": "static route mismatch", "severity": "high"}, "requested_show": ["show running-config | include ip route", "show ip route static"]}
{"instruction": "Wazuh detected event 'vlan mismatch detected' on device CORE-R1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.254.22.202", "event": "vlan mismatch detected", "severity": "high"}, "requested_show": ["show vlan brief", "show interfaces trunk"]}
{"instruction": "Wazuh detected event 'mac flapping detected' on device ACCESS-SW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.223.145.242", "event": "mac flapping detected", "severity": "high"}, "requested_show": ["show mac address-table move", "show mac address-table", "show spanning-tree"]}
{"instruction": "Wazuh detected event 'ospf lsa flood' on device ACCESS-SW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.32.195.16", "event": "ospf lsa flood", "severity": "medium"}, "requested_show": ["show ip ospf database", "show ip ospf"]}
{"instruction": "Wazuh detected event 'port scan detected' on device BRANCH-RTR1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.25.143.78", "event": "port scan detected", "severity": "low"}, "requested_show": ["show firewall", "show ip traffic", "show conn", "show access-lists"]}
{"instruction": "Wazuh detected event 'lldp neighbor mismatch' on device ACCESS-SW2 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.164.34.106", "event": "lldp neighbor mismatch", "severity": "low"}, "requested_show": ["show lldp neighbors detail", "show lldp neighbors"]}
{"instruction": "Wazuh detected event 'acl hitcount anomaly' on device BRANCH-RTR1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.141.155.91", "event": "acl hitcount anomaly", "severity": "critical"}, "requested_show": ["show access-lists", "show access-lists | include hitcnt"]}
{"instruction": "Wazuh detected event 'bgp route leak suspected' on device EDGE-FW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.114.65.69", "event": "bgp route leak suspected", "severity": "critical"}, "requested_show": ["show ip bgp neighbors", "show ip bgp", "show ip route"]}
{"instruction": "Wazuh detected event 'snmp brute-force' on device EDGE-FW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.137.156.246", "event": "snmp brute-force", "severity": "high"}, "requested_show": ["show logging | include SNMP", "show snmp user", "show snmp group"]}
{"instruction": "Wazuh detected event 'acl blocking legitimate traffic' on device CORE-R1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.152.107.77", "event": "acl blocking legitimate traffic", "severity": "low"}, "requested_show": ["show access-lists", "show ip interface", "show logging | include DENY", "show ip route"]}
{"instruction": "Wazuh detected event 'acl hitcount anomaly' on device CORE-R1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.187.78.81", "event": "acl hitcount anomaly", "severity": "high"}, "requested_show": ["show access-lists | include hitcnt", "show access-lists"]}
{"instruction": "Wazuh detected event 'ntp sync lost' on device EDGE-FW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.93.78.230", "event": "ntp sync lost", "severity": "low"}, "requested_show": ["show clock", "show ntp status", "show ntp associations"]}
{"instruction": "Wazuh detected event 'firewall deny excessive' on device ACCESS-SW2 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.24.254.150", "event": "firewall deny excessive", "severity": "medium"}, "requested_show": ["show conn", "show access-lists", "show firewall"]}
{"instruction": "Wazuh detected event 'link duplex mismatch' on device ACCESS-SW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.64.133.221", "event": "link duplex mismatch", "severity": "high"}, "requested_show": ["show interfaces", "show controllers"]}
{"instruction": "Wazuh detected event 'syslog flood detected' on device ACCESS-SW2 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.123.126.165", "event": "syslog flood detected", "severity": "high"}, "requested_show": ["show interfaces counters", "show logging", "show ip traffic"]}
{"instruction": "Wazuh detected event 'tcp retransmissions high' on device EDGE-FW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.47.63.198", "event": "tcp retransmissions high", "severity": "high"}, "requested_show": ["show ip traffic", "show interfaces", "show ip tcp statistics"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device CORE-R1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.165.175.134", "event": "dns exfiltration suspected", "severity": "medium"}, "requested_show": ["show logging | include DNS", "show ip traffic", "show ip dns view"]}
{"instruction": "Wazuh detected event 'nat translation failure' on device EDGE-FW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.133.49.53", "event": "nat translation failure", "severity": "critical"}, "requested_show": ["show ip nat statistics", "show ip nat translations"]}
{"instruction": "Wazuh detected event 'cdp rogue device' on device BRANCH-RTR1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.48.244.243", "event": "cdp rogue device", "severity": "high"}, "requested_show": ["show cdp neighbors", "show cdp neighbors detail"]}
{"instruction": "Wazuh detected event 'acl blocking legitimate traffic' on device CORE-R1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.51.44.149", "event": "acl blocking legitimate traffic", "severity": "high"}, "requested_show": ["show ip route", "show logging | include DENY", "show ip interface", "show access-lists"]}
{"instruction": "Wazuh detected event 'ssh brute-force' on device CORE-R1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.200.105.207", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show ip ssh", "show logging | include SSH", "show users", "show access-lists", "show ip interface brief"]}
{"instruction": "Wazuh detected event 'firewall deny excessive' on device ACCESS-SW2 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.200.220.21", "event": "firewall deny excessive", "severity": "critical"}, "requested_show": ["show conn", "show firewall", "show access-lists"]}
{"instruction": "Wazuh detected event 'link duplex mismatch' on device BRANCH-RTR1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.170.227.20", "event": "link duplex mismatch", "severity": "critical"}, "requested_show": ["show interfaces", "show controllers"]}
{"instruction": "Wazuh detected event 'firewall deny excessive' on device BRANCH-RTR1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.88.142.63", "event": "firewall deny excessive", "severity": "critical"}, "requested_show": ["show conn", "show access-lists", "show firewall"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device EDGE-FW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.134.222.90", "event": "dhcp starvation attack", "severity": "low"}, "requested_show": ["show ip dhcp binding", "show mac address-table", "show ip dhcp conflict"]}
{"instruction": "Wazuh detected event 'port scan detected' on device EDGE-FW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.74.255.155", "event": "port scan detected", "severity": "low"}, "requested_show": ["show ip traffic", "show conn", "show access-lists", "show logging | include DENY", "show firewall"]}
{"instruction": "Wazuh detected event 'link duplex mismatch' on device ACCESS-SW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.229.128.222", "event": "link duplex mismatch", "severity": "critical"}, "requested_show": ["show controllers", "show interfaces"]}
{"instruction": "Wazuh detected event 'cdp rogue device' on device ACCESS-SW2 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.176.192.230", "event": "cdp rogue device", "severity": "low"}, "requested_show": ["show cdp neighbors", "show cdp neighbors detail"]}
{"instruction": "Wazuh detected event 'blacklisted ip communication' on device BRANCH-RTR1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.97.204.1", "event": "blacklisted ip communication", "severity": "low"}, "requested_show": ["show logging | include DENY", "show access-lists", "show conn address", "show ip route"]}
{"instruction": "Wazuh detected event 'ip conflict detected' on device EDGE-FW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.11.11.169", "event": "ip conflict detected", "severity": "critical"}, "requested_show": ["show arp", "show logging | include DUPLICATE", "show ip interface"]}
{"instruction": "Wazuh detected event 'vrf route leak' on device BRANCH-RTR1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.248.80.71", "event": "vrf route leak", "severity": "high"}, "requested_show": ["show ip vrf", "show ip route vrf"]}
{"instruction": "Wazuh detected event 'tcp retransmissions high' on device ACCESS-SW2 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.48.178.43", "event": "tcp retransmissions high", "severity": "low"}, "requested_show": ["show interfaces", "show ip tcp statistics", "show ip traffic"]}
{"instruction": "Wazuh detected event 'ssh brute-force' on device BRANCH-RTR1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.49.253.97", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show users", "show ip interface brief", "show ip ssh", "show access-lists"]}
{"instruction": "Wazuh detected event 'interface flapping' on device BRANCH-RTR1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.58.192.54", "event": "interface flapping", "severity": "medium"}, "requested_show": ["show interfaces status", "show interfaces", "show logging | include LINK"]}
{"instruction": "Wazuh detected event 'bgp route leak suspected' on device BRANCH-RTR1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.11.117.69", "event": "bgp route leak suspected", "severity": "medium"}, "requested_show": ["show ip bgp neighbors", "show ip route", "show ip bgp"]}
{"instruction": "Wazuh detected event 'port scan detected' on device ACCESS-SW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.46.137.54", "event": "port scan detected", "severity": "low"}, "requested_show": ["show access-lists", "show conn", "show firewall", "show ip traffic"]}
{"instruction": "Wazuh detected event 'static route mismatch' on device ACCESS-SW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.22.111.106", "event": "static route mismatch", "severity": "high"}, "requested_show": ["show running-config | include ip route", "show ip route static"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device BRANCH-RTR1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.150.110.11", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show ip ospf interface", "show interfaces", "show ip ospf neighbor", "show ip ospf database"]}
{"instruction": "Wazuh detected event 'bgp session flap' on device ACCESS-SW2 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.137.22.140", "event": "bgp session flap", "severity": "low"}, "requested_show": ["show ip route", "show logging | include BGP", "show ip bgp summary", "show ip bgp neighbors"]}
{"instruction": "Wazuh detected event 'syslog flood detected' on device CORE-R1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.199.209.142", "event": "syslog flood detected", "severity": "high"}, "requested_show": ["show interfaces counters", "show logging", "show ip traffic"]}
{"instruction": "Wazuh detected event 'ipsec rekey storm' on device ACCESS-SW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.8.144.209", "event": "ipsec rekey storm", "severity": "high"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device CORE-R1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.77.126.27", "event": "high cpu usage", "severity": "medium"}, "requested_show": ["show platform resources", "show memory statistics", "show processes cpu sorted"]}
{"instruction": "Wazuh detected event 'ddos high connection rate' on device BRANCH-RTR1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.95.253.119", "event": "ddos high connection rate", "severity": "high"}, "requested_show": ["show ip traffic", "show interfaces counters", "show conn"]}
{"instruction": "Wazuh detected event 'mtu mismatch' on device ACCESS-SW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.106.218.126", "event": "mtu mismatch", "severity": "low"}, "requested_show": ["show interfaces", "show ip ospf interface"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device ACCESS-SW2 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.13.124.244", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show ip ospf database", "show ip ospf neighbor", "show ip ospf interface", "show interfaces"]}
{"instruction": "Wazuh detected event 'bgp route leak suspected' on device ACCESS-SW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.67.210.219", "event": "bgp route leak suspected", "severity": "high"}, "requested_show": ["show ip bgp", "show ip bgp neighbors", "show ip route"]}
{"instruction": "Wazuh detected event 'interface flapping' on device EDGE-FW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.5.245.92", "event": "interface flapping", "severity": "low"}, "requested_show": ["show interfaces", "show interfaces status", "show logging | include LINK"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device CORE-R1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.114.47.247", "event": "dns exfiltration suspected", "severity": "low"}, "requested_show": ["show logging | include DNS", "show ip traffic", "show ip dns view"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device ACCESS-SW2 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.44.236.188", "event": "arp spoofing suspected", "severity": "low"}, "requested_show": ["show arp", "show ip verify source", "show ip traffic", "show mac address-table"]}
{"instruction": "Wazuh detected event 'mac flapping detected' on device CORE-R1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.164.174.169", "event": "mac flapping detected", "severity": "low"}, "requested_show": ["show spanning-tree", "show mac address-table move", "show mac address-table"]}
{"instruction": "Wazuh detected event 'eigrp neighbor flap' on device EDGE-FW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.236.130.144", "event": "eigrp neighbor flap", "severity": "high"}, "requested_show": ["show ip eigrp neighbors", "show ip eigrp topology"]}
{"instruction": "Wazuh detected event 'memory leak suspected' on device ACCESS-SW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.61.64.117", "event": "memory leak suspected", "severity": "critical"}, "requested_show": ["show memory statistics", "show processes memory sorted"]}
{"instruction": "Wazuh detected event 'stp loop detected' on device EDGE-FW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.61.175.87", "event": "stp loop detected", "severity": "low"}, "requested_show": ["show spanning-tree detail", "show mac address-table move", "show spanning-tree"]}
{"instruction": "Wazuh detected event 'ospf lsa flood' on device ACCESS-SW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.193.84.100", "event": "ospf lsa flood", "severity": "medium"}, "requested_show": ["show ip ospf", "show ip ospf database"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device BRANCH-RTR1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.124.190.130", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show interfaces", "show ip ospf neighbor", "show ip ospf database", "show ip ospf interface"]}
{"instruction": "Wazuh detected event 'acl hitcount anomaly' on device EDGE-FW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.65.155.157", "event": "acl hitcount anomaly", "severity": "critical"}, "requested_show": ["show access-lists", "show access-lists | include hitcnt"]}
{"instruction": "Wazuh detected event 'blacklisted ip communication' on device BRANCH-RTR1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.78.121.237", "event": "blacklisted ip communication", "severity": "medium"}, "requested_show": ["show ip route", "show access-lists", "show logging | include DENY", "show conn address"]}
{"instruction": "Wazuh detected event 'eigrp neighbor flap' on device EDGE-FW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.67.249.133", "event": "eigrp neighbor flap", "severity": "low"}, "requested_show": ["show ip eigrp neighbors", "show ip eigrp topology"]}
{"instruction": "Wazuh detected event 'eigrp neighbor flap' on device CORE-R1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.186.104.56", "event": "eigrp neighbor flap", "severity": "medium"}, "requested_show": ["show ip eigrp topology", "show ip eigrp neighbors"]}
{"instruction": "Wazuh detected event 'ip conflict detected' on device BRANCH-RTR1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.178.117.234", "event": "ip conflict detected", "severity": "high"}, "requested_show": ["show logging | include DUPLICATE", "show arp", "show ip interface"]}
{"instruction": "Wazuh detected event 'interface flapping' on device EDGE-FW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.255.92.185", "event": "interface flapping", "severity": "low"}, "requested_show": ["show interfaces", "show logging | include LINK", "show interfaces status"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device ACCESS-SW2 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.233.17.130", "event": "high cpu usage", "severity": "low"}, "requested_show": ["show platform resources", "show processes cpu sorted", "show memory statistics"]}
{"instruction": "Wazuh detected event 'packet loss detected' on device ACCESS-SW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.60.95.42", "event": "packet loss detected", "severity": "critical"}, "requested_show": ["show interfaces counters errors", "show interfaces"]}
{"instruction": "Wazuh detected event 'vlan mismatch detected' on device CORE-R1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.70.203.68", "event": "vlan mismatch detected", "severity": "high"}, "requested_show": ["show vlan brief", "show interfaces trunk"]}
{"instruction": "Wazuh detected event 'memory leak suspected' on device CORE-R1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.3.234.254", "event": "memory leak suspected", "severity": "critical"}, "requested_show": ["show memory statistics", "show processes memory sorted"]}
{"instruction": "Wazuh detected event 'subnet overlap detected' on device BRANCH-RTR1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.19.93.178", "event": "subnet overlap detected", "severity": "critical"}, "requested_show": ["show running-config | include ip address", "show ip route"]}
{"instruction": "Wazuh detected event 'ip conflict detected' on device EDGE-FW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.120.218.26", "event": "ip conflict detected", "severity": "critical"}, "requested_show": ["show arp", "show ip interface", "show logging | include DUPLICATE"]}
{"instruction": "Wazuh detected event 'cdp rogue device' on device BRANCH-RTR1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.252.190.108", "event": "cdp rogue device", "severity": "low"}, "requested_show": ["show cdp neighbors detail", "show cdp neighbors"]}
{"instruction": "Wazuh detected event 'link duplex mismatch' on device ACCESS-SW2 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.249.64.44", "event": "link duplex mismatch", "severity": "high"}, "requested_show": ["show controllers", "show interfaces"]}
{"instruction": "Wazuh detected event 'nat translation failure' on device BRANCH-RTR1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.126.183.235", "event": "nat translation failure", "severity": "critical"}, "requested_show": ["show ip nat translations", "show ip nat statistics"]}
{"instruction": "Wazuh detected event 'nat translation failure' on device EDGE-FW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.4.133.98", "event": "nat translation failure", "severity": "medium"}, "requested_show": ["show ip nat translations", "show ip nat statistics"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device EDGE-FW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.13.87.88", "event": "dhcp starvation attack", "severity": "high"}, "requested_show": ["show ip dhcp conflict", "show ip dhcp binding", "show mac address-table"]}
{"instruction": "Wazuh detected event 'packet loss detected' on device BRANCH-RTR1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.46.123.59", "event": "packet loss detected", "severity": "low"}, "requested_show": ["show interfaces", "show interfaces counters errors"]}
{"instruction": "Wazuh detected event 'eigrp neighbor flap' on device ACCESS-SW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.230.39.249", "event": "eigrp neighbor flap", "severity": "low"}, "requested_show": ["show ip eigrp topology", "show ip eigrp neighbors"]}
{"instruction": "Wazuh detected event 'eigrp neighbor flap' on device ACCESS-SW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.168.186.25", "event": "eigrp neighbor flap", "severity": "low"}, "requested_show": ["show ip eigrp neighbors", "show ip eigrp topology"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device ACCESS-SW2 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.16.167.50", "event": "dhcp starvation attack", "severity": "high"}, "requested_show": ["show mac address-table", "show ip dhcp binding", "show ip dhcp conflict"]}
{"instruction": "Wazuh detected event 'cdp rogue device' on device EDGE-FW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.72.236.249", "event": "cdp rogue device", "severity": "medium"}, "requested_show": ["show cdp neighbors", "show cdp neighbors detail"]}
{"instruction": "Wazuh detected event 'acl hitcount anomaly' on device CORE-R1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.177.213.127", "event": "acl hitcount anomaly", "severity": "critical"}, "requested_show": ["show access-lists | include hitcnt", "show access-lists"]}
{"instruction": "Wazuh detected event 'snmp brute-force' on device CORE-R1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.74.235.184", "event": "snmp brute-force", "severity": "medium"}, "requested_show": ["show snmp group", "show logging | include SNMP", "show snmp user"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device CORE-R1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.124.202.38", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show ip traffic", "show ip verify source", "show arp", "show mac address-table"]}
{"instruction": "Wazuh detected event 'mtu mismatch' on device EDGE-FW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.56.158.116", "event": "mtu mismatch", "severity": "critical"}, "requested_show": ["show interfaces", "show ip ospf interface"]}
{"instruction": "Wazuh detected event 'link duplex mismatch' on device ACCESS-SW2 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.82.64.100", "event": "link duplex mismatch", "severity": "high"}, "requested_show": ["show controllers", "show interfaces"]}
{"instruction": "Wazuh detected event 'bgp route leak suspected' on device ACCESS-SW2 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.113.192.57", "event": "bgp route leak suspected", "severity": "low"}, "requested_show": ["show ip bgp neighbors", "show ip route", "show ip bgp"]}
{"instruction": "Wazuh detected event 'snmp brute-force' on device ACCESS-SW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.51.120.24", "event": "snmp brute-force", "severity": "low"}, "requested_show": ["show logging | include SNMP", "show snmp user", "show snmp group"]}
{"instruction": "Wazuh detected event 'blacklisted ip communication' on device ACCESS-SW2 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.124.56.41", "event": "blacklisted ip communication", "severity": "medium"}, "requested_show": ["show logging | include DENY", "show ip route", "show access-lists", "show conn address"]}
{"instruction": "Wazuh detected event 'mtu mismatch' on device BRANCH-RTR1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.110.7.100", "event": "mtu mismatch", "severity": "medium"}, "requested_show": ["show ip ospf interface", "show interfaces"]}
{"instruction": "Wazuh detected event 'stp loop detected' on device ACCESS-SW2 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.25.250.6", "event": "stp loop detected", "severity": "critical"}, "requested_show": ["show spanning-tree", "show spanning-tree detail", "show mac address-table move"]}
{"instruction": "Wazuh detected event 'bgp route leak suspected' on device EDGE-FW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.7.41.70", "event": "bgp route leak suspected", "severity": "high"}, "requested_show": ["show ip bgp neighbors", "show ip route", "show ip bgp"]}
{"instruction": "Wazuh detected event 'link duplex mismatch' on device CORE-R1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.82.182.177", "event": "link duplex mismatch", "severity": "low"}, "requested_show": ["show interfaces", "show controllers"]}
{"instruction": "Wazuh detected event 'ipsec rekey storm' on device ACCESS-SW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.78.165.21", "event": "ipsec rekey storm", "severity": "low"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected event 'mtu mismatch' on device EDGE-FW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.176.221.97", "event": "mtu mismatch", "severity": "medium"}, "requested_show": ["show ip ospf interface", "show interfaces"]}
{"instruction": "Wazuh detected event 'vlan mismatch detected' on device EDGE-FW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.68.205.69", "event": "vlan mismatch detected", "severity": "medium"}, "requested_show": ["show interfaces trunk", "show vlan brief"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device ACCESS-SW2 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.137.20.213", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show interfaces", "show ip ospf neighbor", "show ip ospf database", "show ip ospf interface"]}
{"instruction": "Wazuh detected event 'bgp route leak suspected' on device ACCESS-SW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.205.162.243", "event": "bgp route leak suspected", "severity": "low"}, "requested_show": ["show ip route", "show ip bgp neighbors", "show ip bgp"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device ACCESS-SW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.166.189.75", "event": "failed login attempts", "severity": "medium"}, "requested_show": ["show users", "show logging | include LOGIN", "show ip ssh"]}
{"instruction": "Wazuh detected event 'snmp brute-force' on device ACCESS-SW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.11.206.21", "event": "snmp brute-force", "severity": "medium"}, "requested_show": ["show snmp group", "show logging | include SNMP", "show snmp user"]}
{"instruction": "Wazuh detected event 'mac flapping detected' on device CORE-R1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.255.87.220", "event": "mac flapping detected", "severity": "medium"}, "requested_show": ["show mac address-table", "show mac address-table move", "show spanning-tree"]}
{"instruction": "Wazuh detected event 'ssh brute-force' on device CORE-R1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.126.234.253", "event": "ssh brute-force", "severity": "medium"}, "requested_show": ["show users", "show logging | include SSH", "show ip ssh", "show ip interface brief"]}
{"instruction": "Wazuh detected event 'bgp session flap' on device EDGE-FW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.240.197.23", "event": "bgp session flap", "severity": "medium"}, "requested_show": ["show ip bgp summary", "show ip bgp neighbors", "show logging | include BGP", "show ip route"]}
{"instruction": "Wazuh detected event 'vrf route leak' on device ACCESS-SW2 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.38.110.131", "event": "vrf route leak", "severity": "critical"}, "requested_show": ["show ip route vrf", "show ip vrf"]}
{"instruction": "Wazuh detected event 'acl blocking legitimate traffic' on device ACCESS-SW2 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.253.3.121", "event": "acl blocking legitimate traffic", "severity": "medium"}, "requested_show": ["show access-lists", "show logging | include DENY", "show ip interface", "show ip route"]}
{"instruction": "Wazuh detected event 'snmp brute-force' on device CORE-R1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.31.196.254", "event": "snmp brute-force", "severity": "medium"}, "requested_show": ["show snmp user", "show snmp group", "show logging | include SNMP"]}
{"instruction": "Wazuh detected event 'packet loss detected' on device BRANCH-RTR1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.136.240.143", "event": "packet loss detected", "severity": "high"}, "requested_show": ["show interfaces counters errors", "show interfaces"]}
{"instruction": "Wazuh detected event 'memory leak suspected' on device ACCESS-SW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.232.204.253", "event": "memory leak suspected", "severity": "critical"}, "requested_show": ["show processes memory sorted", "show memory statistics"]}
{"instruction": "Wazuh detected event 'interface flapping' on device CORE-R1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.43.112.215", "event": "interface flapping", "severity": "critical"}, "requested_show": ["show interfaces status", "show logging | include LINK", "show interfaces"]}
{"instruction": "Wazuh detected event 'memory leak suspected' on device CORE-R1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.195.125.206", "event": "memory leak suspected", "severity": "high"}, "requested_show": ["show memory statistics", "show processes memory sorted"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device ACCESS-SW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.228.6.196", "event": "failed login attempts", "severity": "low"}, "requested_show": ["show users", "show ip ssh", "show logging | include LOGIN"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device EDGE-FW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.17.111.147", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show arp", "show mac address-table", "show ip verify source", "show ip traffic"]}
{"instruction": "Wazuh detected event 'bgp route leak suspected' on device BRANCH-RTR1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.4.194.235", "event": "bgp route leak suspected", "severity": "medium"}, "requested_show": ["show ip bgp neighbors", "show ip bgp", "show ip route"]}
{"instruction": "Wazuh detected event 'interface flapping' on device ACCESS-SW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.201.65.242", "event": "interface flapping", "severity": "medium"}, "requested_show": ["show interfaces status", "show interfaces", "show logging | include LINK"]}
{"instruction": "Wazuh detected event 'snmp brute-force' on device ACCESS-SW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.66.35.110", "event": "snmp brute-force", "severity": "low"}, "requested_show": ["show logging | include SNMP", "show snmp user", "show snmp group"]}
{"instruction": "Wazuh detected event 'eigrp neighbor flap' on device CORE-R1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.115.187.171", "event": "eigrp neighbor flap", "severity": "high"}, "requested_show": ["show ip eigrp neighbors", "show ip eigrp topology"]}
{"instruction": "Wazuh detected event 'stp loop detected' on device ACCESS-SW2 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.213.184.246", "event": "stp loop detected", "severity": "medium"}, "requested_show": ["show spanning-tree detail", "show mac address-table move", "show spanning-tree"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device EDGE-FW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.70.53.19", "event": "dns exfiltration suspected", "severity": "high"}, "requested_show": ["show ip traffic", "show ip dns view", "show logging | include DNS"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device EDGE-FW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.63.13.118", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show interfaces", "show ip ospf interface", "show ip ospf neighbor", "show ip ospf database"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device CORE-R1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.33.187.20", "event": "high cpu usage", "severity": "critical"}, "requested_show": ["show memory statistics", "show processes cpu sorted", "show platform resources"]}
{"instruction": "Wazuh detected event 'syslog flood detected' on device BRANCH-RTR1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.41.249.191", "event": "syslog flood detected", "severity": "low"}, "requested_show": ["show interfaces counters", "show ip traffic", "show logging"]}
{"instruction": "Wazuh detected event 'snmp brute-force' on device ACCESS-SW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.151.173.159", "event": "snmp brute-force", "severity": "low"}, "requested_show": ["show snmp group", "show snmp user", "show logging | include SNMP"]}
{"instruction": "Wazuh detected event 'ipsec rekey storm' on device BRANCH-RTR1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.188.203.34", "event": "ipsec rekey storm", "severity": "critical"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected event 'nat translation failure' on device BRANCH-RTR1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.116.97.48", "event": "nat translation failure", "severity": "high"}, "requested_show": ["show ip nat translations", "show ip nat statistics"]}
{"instruction": "Wazuh detected event 'stp loop detected' on device CORE-R1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.10.94.244", "event": "stp loop detected", "severity": "low"}, "requested_show": ["show spanning-tree", "show mac address-table move", "show spanning-tree detail"]}
{"instruction": "Wazuh detected event 'ddos high connection rate' on device BRANCH-RTR1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.30.189.38", "event": "ddos high connection rate", "severity": "medium"}, "requested_show": ["show conn", "show interfaces counters", "show ip traffic"]}
{"instruction": "Wazuh detected event 'bgp route leak suspected' on device CORE-R1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.5.224.229", "event": "bgp route leak suspected", "severity": "low"}, "requested_show": ["show ip route", "show ip bgp neighbors", "show ip bgp"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device EDGE-FW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.222.157.54", "event": "failed login attempts", "severity": "low"}, "requested_show": ["show users", "show ip ssh", "show logging | include LOGIN"]}
{"instruction": "Wazuh detected event 'cdp rogue device' on device EDGE-FW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.43.226.65", "event": "cdp rogue device", "severity": "low"}, "requested_show": ["show cdp neighbors detail", "show cdp neighbors"]}
{"instruction": "Wazuh detected event 'subnet overlap detected' on device ACCESS-SW2 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.48.121.1", "event": "subnet overlap detected", "severity": "high"}, "requested_show": ["show ip route", "show running-config | include ip address"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device CORE-R1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.60.220.76", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show interfaces", "show ip ospf interface", "show ip ospf neighbor", "show ip ospf database"]}
{"instruction": "Wazuh detected event 'blacklisted ip communication' on device EDGE-FW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.1.83.215", "event": "blacklisted ip communication", "severity": "high"}, "requested_show": ["show ip route", "show conn address", "show logging | include DENY", "show access-lists"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device EDGE-FW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.5.131.125", "event": "arp spoofing suspected", "severity": "low"}, "requested_show": ["show mac address-table", "show arp", "show ip verify source", "show ip traffic"]}
{"instruction": "Wazuh detected event 'ddos high connection rate' on device BRANCH-RTR1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.216.141.160", "event": "ddos high connection rate", "severity": "high"}, "requested_show": ["show conn", "show interfaces counters", "show ip traffic"]}
{"instruction": "Wazuh detected event 'bgp session flap' on device EDGE-FW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.45.244.248", "event": "bgp session flap", "severity": "medium"}, "requested_show": ["show logging | include BGP", "show ip bgp summary", "show ip bgp neighbors", "show ip route"]}
{"instruction": "Wazuh detected event 'eigrp neighbor flap' on device CORE-R1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.158.226.24", "event": "eigrp neighbor flap", "severity": "critical"}, "requested_show": ["show ip eigrp neighbors", "show ip eigrp topology"]}
{"instruction": "Wazuh detected event 'subnet overlap detected' on device ACCESS-SW2 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.239.232.192", "event": "subnet overlap detected", "severity": "high"}, "requested_show": ["show ip route", "show running-config | include ip address"]}
{"instruction": "Wazuh detected event 'broadcast storm detected' on device CORE-R1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.6.16.86", "event": "broadcast storm detected", "severity": "high"}, "requested_show": ["show interfaces counters", "show ip traffic", "show mac address-table"]}
{"instruction": "Wazuh detected event 'link duplex mismatch' on device ACCESS-SW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.103.149.130", "event": "link duplex mismatch", "severity": "critical"}, "requested_show": ["show interfaces", "show controllers"]}
{"instruction": "Wazuh detected event 'bgp session flap' on device ACCESS-SW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.219.214.60", "event": "bgp session flap", "severity": "medium"}, "requested_show": ["show ip bgp summary", "show ip bgp neighbors", "show ip route", "show logging | include BGP"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device CORE-R1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.30.131.104", "event": "vpn tunnel down", "severity": "low"}, "requested_show": ["show crypto ipsec sa", "show crypto ikev2 sa", "show interfaces"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device ACCESS-SW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.82.83.18", "event": "dhcp starvation attack", "severity": "high"}, "requested_show": ["show ip dhcp binding", "show mac address-table", "show ip dhcp conflict"]}
{"instruction": "Wazuh detected event 'cdp rogue device' on device ACCESS-SW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.26.69.242", "event": "cdp rogue device", "severity": "low"}, "requested_show": ["show cdp neighbors detail", "show cdp neighbors"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device ACCESS-SW2 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.85.17.249", "event": "vpn tunnel down", "severity": "critical"}, "requested_show": ["show crypto ipsec sa", "show interfaces", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected event 'mac flapping detected' on device BRANCH-RTR1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.2.123.188", "event": "mac flapping detected", "severity": "critical"}, "requested_show": ["show mac address-table move", "show spanning-tree", "show mac address-table"]}
{"instruction": "Wazuh detected event 'vrf route leak' on device ACCESS-SW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.73.220.116", "event": "vrf route leak", "severity": "medium"}, "requested_show": ["show ip vrf", "show ip route vrf"]}
{"instruction": "Wazuh detected event 'eigrp neighbor flap' on device ACCESS-SW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.10.128.246", "event": "eigrp neighbor flap", "severity": "low"}, "requested_show": ["show ip eigrp topology", "show ip eigrp neighbors"]}
{"instruction": "Wazuh detected event 'vlan mismatch detected' on device ACCESS-SW2 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.173.40.157", "event": "vlan mismatch detected", "severity": "medium"}, "requested_show": ["show interfaces trunk", "show vlan brief"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device CORE-R1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.252.233.135", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show mac address-table", "show ip verify source", "show arp", "show ip traffic"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device EDGE-FW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.245.24.92", "event": "failed login attempts", "severity": "low"}, "requested_show": ["show logging | include LOGIN", "show ip ssh", "show users"]}
{"instruction": "Wazuh detected event 'port scan detected' on device BRANCH-RTR1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.129.40.84", "event": "port scan detected", "severity": "critical"}, "requested_show": ["show conn", "show ip traffic", "show logging | include DENY", "show access-lists", "show firewall"]}
{"instruction": "Wazuh detected event 'subnet overlap detected' on device ACCESS-SW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.223.62.84", "event": "subnet overlap detected", "severity": "medium"}, "requested_show": ["show running-config | include ip address", "show ip route"]}
{"instruction": "Wazuh detected event 'ddos high connection rate' on device EDGE-FW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.204.39.89", "event": "ddos high connection rate", "severity": "medium"}, "requested_show": ["show conn", "show interfaces counters", "show ip traffic"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device EDGE-FW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.113.172.217", "event": "arp spoofing suspected", "severity": "critical"}, "requested_show": ["show ip traffic", "show mac address-table", "show arp", "show ip verify source"]}
{"instruction": "Wazuh detected event 'mtu mismatch' on device ACCESS-SW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.74.50.52", "event": "mtu mismatch", "severity": "high"}, "requested_show": ["show interfaces", "show ip ospf interface"]}
{"instruction": "Wazuh detected event 'vrf route leak' on device BRANCH-RTR1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.7.243.66", "event": "vrf route leak", "severity": "low"}, "requested_show": ["show ip route vrf", "show ip vrf"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device EDGE-FW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.118.159.95", "event": "dhcp starvation attack", "severity": "critical"}, "requested_show": ["show ip dhcp binding", "show ip dhcp conflict", "show mac address-table"]}
{"instruction": "Wazuh detected event 'ntp sync lost' on device CORE-R1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.238.17.135", "event": "ntp sync lost", "severity": "medium"}, "requested_show": ["show ntp status", "show clock", "show ntp associations"]}
{"instruction": "Wazuh detected event 'nat translation failure' on device ACCESS-SW2 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.131.1.66", "event": "nat translation failure", "severity": "high"}, "requested_show": ["show ip nat statistics", "show ip nat translations"]}
{"instruction": "Wazuh detected event 'tcp retransmissions high' on device BRANCH-RTR1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.215.249.174", "event": "tcp retransmissions high", "severity": "medium"}, "requested_show": ["show ip traffic", "show interfaces", "show ip tcp statistics"]}
{"instruction": "Wazuh detected event 'interface flapping' on device BRANCH-RTR1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.17.18.124", "event": "interface flapping", "severity": "medium"}, "requested_show": ["show logging | include LINK", "show interfaces", "show interfaces status"]}
{"instruction": "Wazuh detected event 'mac flapping detected' on device EDGE-FW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.100.20.167", "event": "mac flapping detected", "severity": "critical"}, "requested_show": ["show mac address-table", "show spanning-tree", "show mac address-table move"]}
{"instruction": "Wazuh detected event 'mtu mismatch' on device CORE-R1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.99.202.69", "event": "mtu mismatch", "severity": "critical"}, "requested_show": ["show ip ospf interface", "show interfaces"]}
{"instruction": "Wazuh detected event 'acl blocking legitimate traffic' on device ACCESS-SW2 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.180.26.210", "event": "acl blocking legitimate traffic", "severity": "high"}, "requested_show": ["show access-lists", "show ip interface", "show ip route", "show logging | include DENY"]}
{"instruction": "Wazuh detected event 'firewall deny excessive' on device ACCESS-SW2 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.137.19.141", "event": "firewall deny excessive", "severity": "low"}, "requested_show": ["show access-lists", "show conn", "show firewall"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device CORE-R1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.218.36.67", "event": "dhcp starvation attack", "severity": "medium"}, "requested_show": ["show mac address-table", "show ip dhcp binding", "show ip dhcp conflict"]}
{"instruction": "Wazuh detected event 'memory leak suspected' on device ACCESS-SW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.117.30.248", "event": "memory leak suspected", "severity": "low"}, "requested_show": ["show processes memory sorted", "show memory statistics"]}
{"instruction": "Wazuh detected event 'snmp brute-force' on device ACCESS-SW2 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.28.79.252", "event": "snmp brute-force", "severity": "medium"}, "requested_show": ["show snmp group", "show logging | include SNMP", "show snmp user"]}
{"instruction": "Wazuh detected event 'static route mismatch' on device EDGE-FW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.115.245.72", "event": "static route mismatch", "severity": "low"}, "requested_show": ["show ip route static", "show running-config | include ip route"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device BRANCH-RTR1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.192.65.157", "event": "high cpu usage", "severity": "critical"}, "requested_show": ["show processes cpu sorted", "show platform resources", "show memory statistics"]}
{"instruction": "Wazuh detected event 'blacklisted ip communication' on device EDGE-FW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.62.143.156", "event": "blacklisted ip communication", "severity": "critical"}, "requested_show": ["show ip route", "show logging | include DENY", "show access-lists", "show conn address"]}
{"instruction": "Wazuh detected event 'bgp session flap' on device ACCESS-SW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.120.21.208", "event": "bgp session flap", "severity": "medium"}, "requested_show": ["show ip bgp neighbors", "show logging | include BGP", "show ip bgp summary", "show ip route"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device EDGE-FW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.49.99.32", "event": "dhcp starvation attack", "severity": "critical"}, "requested_show": ["show mac address-table", "show ip dhcp conflict", "show ip dhcp binding"]}
{"instruction": "Wazuh detected event 'mac flapping detected' on device ACCESS-SW2 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.33.28.179", "event": "mac flapping detected", "severity": "high"}, "requested_show": ["show mac address-table move", "show spanning-tree", "show mac address-table"]}
{"instruction": "Wazuh detected event 'packet loss detected' on device ACCESS-SW2 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.118.67.212", "event": "packet loss detected", "severity": "critical"}, "requested_show": ["show interfaces counters errors", "show interfaces"]}
{"instruction": "Wazuh detected event 'packet loss detected' on device ACCESS-SW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.116.157.185", "event": "packet loss detected", "severity": "medium"}, "requested_show": ["show interfaces", "show interfaces counters errors"]}
{"instruction": "Wazuh detected event 'ip conflict detected' on device BRANCH-RTR1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.17.29.55", "event": "ip conflict detected", "severity": "high"}, "requested_show": ["show ip interface", "show logging | include DUPLICATE", "show arp"]}
{"instruction": "Wazuh detected event 'bgp route leak suspected' on device ACCESS-SW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.80.221.32", "event": "bgp route leak suspected", "severity": "low"}, "requested_show": ["show ip bgp neighbors", "show ip bgp", "show ip route"]}
{"instruction": "Wazuh detected event 'snmp brute-force' on device EDGE-FW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.145.110.2", "event": "snmp brute-force", "severity": "medium"}, "requested_show": ["show snmp user", "show snmp group", "show logging | include SNMP"]}
{"instruction": "Wazuh detected event 'interface flapping' on device ACCESS-SW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.19.179.96", "event": "interface flapping", "severity": "critical"}, "requested_show": ["show interfaces", "show logging | include LINK", "show interfaces status"]}
{"instruction": "Wazuh detected event 'link duplex mismatch' on device ACCESS-SW2 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.247.237.1", "event": "link duplex mismatch", "severity": "low"}, "requested_show": ["show interfaces", "show controllers"]}
{"instruction": "Wazuh detected event 'ddos high connection rate' on device ACCESS-SW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.51.147.119", "event": "ddos high connection rate", "severity": "medium"}, "requested_show": ["show interfaces counters", "show conn", "show ip traffic"]}
{"instruction": "Wazuh detected event 'static route mismatch' on device ACCESS-SW2 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.90.204.131", "event": "static route mismatch", "severity": "medium"}, "requested_show": ["show ip route static", "show running-config | include ip route"]}
{"instruction": "Wazuh detected event 'subnet overlap detected' on device ACCESS-SW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.78.91.69", "event": "subnet overlap detected", "severity": "critical"}, "requested_show": ["show running-config | include ip address", "show ip route"]}
{"instruction": "Wazuh detected event 'mtu mismatch' on device CORE-R1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.121.123.218", "event": "mtu mismatch", "severity": "medium"}, "requested_show": ["show interfaces", "show ip ospf interface"]}
{"instruction": "Wazuh detected event 'port scan detected' on device CORE-R1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.143.171.152", "event": "port scan detected", "severity": "medium"}, "requested_show": ["show access-lists", "show firewall", "show conn", "show logging | include DENY", "show ip traffic"]}
{"instruction": "Wazuh detected event 'acl blocking legitimate traffic' on device ACCESS-SW2 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.65.187.98", "event": "acl blocking legitimate traffic", "severity": "critical"}, "requested_show": ["show logging | include DENY", "show ip interface", "show ip route", "show access-lists"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device CORE-R1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.214.248.122", "event": "dhcp starvation attack", "severity": "low"}, "requested_show": ["show ip dhcp binding", "show mac address-table", "show ip dhcp conflict"]}
{"instruction": "Wazuh detected event 'ospf lsa flood' on device EDGE-FW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.126.183.229", "event": "ospf lsa flood", "severity": "critical"}, "requested_show": ["show ip ospf database", "show ip ospf"]}
{"instruction": "Wazuh detected event 'lldp neighbor mismatch' on device ACCESS-SW2 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.79.169.68", "event": "lldp neighbor mismatch", "severity": "high"}, "requested_show": ["show lldp neighbors", "show lldp neighbors detail"]}
{"instruction": "Wazuh detected event 'stp loop detected' on device ACCESS-SW2 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.158.157.183", "event": "stp loop detected", "severity": "low"}, "requested_show": ["show spanning-tree", "show spanning-tree detail", "show mac address-table move"]}
{"instruction": "Wazuh detected event 'interface flapping' on device EDGE-FW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.68.203.246", "event": "interface flapping", "severity": "high"}, "requested_show": ["show interfaces", "show logging | include LINK", "show interfaces status"]}
{"instruction": "Wazuh detected event 'ssh brute-force' on device EDGE-FW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.83.237.60", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show ip ssh", "show access-lists", "show users", "show logging | include SSH", "show ip interface brief"]}
{"instruction": "Wazuh detected event 'ipsec rekey storm' on device EDGE-FW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.24.128.48", "event": "ipsec rekey storm", "severity": "high"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected event 'ntp sync lost' on device ACCESS-SW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.118.223.174", "event": "ntp sync lost", "severity": "high"}, "requested_show": ["show ntp associations", "show clock", "show ntp status"]}
{"instruction": "Wazuh detected event 'packet loss detected' on device BRANCH-RTR1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.177.106.117", "event": "packet loss detected", "severity": "high"}, "requested_show": ["show interfaces", "show interfaces counters errors"]}
{"instruction": "Wazuh detected event 'broadcast storm detected' on device EDGE-FW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.104.183.56", "event": "broadcast storm detected", "severity": "low"}, "requested_show": ["show interfaces counters", "show mac address-table", "show ip traffic"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device ACCESS-SW2 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.13.173.206", "event": "dns exfiltration suspected", "severity": "medium"}, "requested_show": ["show ip traffic", "show logging | include DNS", "show ip dns view"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device EDGE-FW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.26.107.199", "event": "high cpu usage", "severity": "critical"}, "requested_show": ["show processes cpu sorted", "show platform resources", "show memory statistics"]}
{"instruction": "Wazuh detected event 'static route mismatch' on device ACCESS-SW2 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.195.80.226", "event": "static route mismatch", "severity": "medium"}, "requested_show": ["show running-config | include ip route", "show ip route static"]}
{"instruction": "Wazuh detected event 'mtu mismatch' on device BRANCH-RTR1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.139.186.226", "event": "mtu mismatch", "severity": "high"}, "requested_show": ["show interfaces", "show ip ospf interface"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device EDGE-FW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.183.70.22", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show crypto ikev2 sa", "show interfaces", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device CORE-R1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.192.154.42", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show interfaces", "show crypto ikev2 sa", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected event 'mac flapping detected' on device CORE-R1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.193.93.83", "event": "mac flapping detected", "severity": "low"}, "requested_show": ["show spanning-tree", "show mac address-table", "show mac address-table move"]}
{"instruction": "Wazuh detected event 'ipsec rekey storm' on device BRANCH-RTR1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.93.178.54", "event": "ipsec rekey storm", "severity": "low"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected event 'broadcast storm detected' on device EDGE-FW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.179.163.143", "event": "broadcast storm detected", "severity": "medium"}, "requested_show": ["show ip traffic", "show mac address-table", "show interfaces counters"]}
{"instruction": "Wazuh detected event 'firewall deny excessive' on device BRANCH-RTR1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.159.57.194", "event": "firewall deny excessive", "severity": "low"}, "requested_show": ["show conn", "show access-lists", "show firewall"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device EDGE-FW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.162.126.94", "event": "failed login attempts", "severity": "critical"}, "requested_show": ["show ip ssh", "show users", "show logging | include LOGIN"]}
{"instruction": "Wazuh detected event 'acl blocking legitimate traffic' on device EDGE-FW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.39.84.168", "event": "acl blocking legitimate traffic", "severity": "high"}, "requested_show": ["show ip route", "show logging | include DENY", "show access-lists", "show ip interface"]}
{"instruction": "Wazuh detected event 'vrf route leak' on device BRANCH-RTR1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.33.40.157", "event": "vrf route leak", "severity": "low"}, "requested_show": ["show ip vrf", "show ip route vrf"]}
{"instruction": "Wazuh detected event 'mac flapping detected' on device ACCESS-SW2 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.75.229.1", "event": "mac flapping detected", "severity": "low"}, "requested_show": ["show mac address-table", "show spanning-tree", "show mac address-table move"]}
{"instruction": "Wazuh detected event 'bgp route leak suspected' on device ACCESS-SW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.67.117.93", "event": "bgp route leak suspected", "severity": "medium"}, "requested_show": ["show ip bgp", "show ip bgp neighbors", "show ip route"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device EDGE-FW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.43.156.248", "event": "dns exfiltration suspected", "severity": "critical"}, "requested_show": ["show ip traffic", "show ip dns view", "show logging | include DNS"]}
{"instruction": "Wazuh detected event 'firewall deny excessive' on device CORE-R1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.101.209.230", "event": "firewall deny excessive", "severity": "critical"}, "requested_show": ["show access-lists", "show firewall", "show conn"]}
{"instruction": "Wazuh detected event 'mac flapping detected' on device ACCESS-SW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.223.28.238", "event": "mac flapping detected", "severity": "critical"}, "requested_show": ["show spanning-tree", "show mac address-table move", "show mac address-table"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device BRANCH-RTR1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.235.16.36", "event": "dhcp starvation attack", "severity": "critical"}, "requested_show": ["show ip dhcp binding", "show mac address-table", "show ip dhcp conflict"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device ACCESS-SW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.4.18.143", "event": "failed login attempts", "severity": "low"}, "requested_show": ["show ip ssh", "show users", "show logging | include LOGIN"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device CORE-R1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.57.111.190", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show processes cpu sorted", "show memory statistics", "show platform resources"]}
{"instruction": "Wazuh detected event 'port scan detected' on device ACCESS-SW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.160.214.32", "event": "port scan detected", "severity": "low"}, "requested_show": ["show firewall", "show ip traffic", "show access-lists", "show conn"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device BRANCH-RTR1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.148.113.155", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show crypto ipsec sa", "show crypto ikev2 sa", "show interfaces"]}
{"instruction": "Wazuh detected event 'bgp route leak suspected' on device CORE-R1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.84.85.24", "event": "bgp route leak suspected", "severity": "critical"}, "requested_show": ["show ip bgp neighbors", "show ip bgp", "show ip route"]}
{"instruction": "Wazuh detected event 'ntp sync lost' on device BRANCH-RTR1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.89.49.42", "event": "ntp sync lost", "severity": "medium"}, "requested_show": ["show clock", "show ntp status", "show ntp associations"]}
{"instruction": "Wazuh detected event 'static route mismatch' on device CORE-R1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.54.198.193", "event": "static route mismatch", "severity": "critical"}, "requested_show": ["show ip route static", "show running-config | include ip route"]}
{"instruction": "Wazuh detected event 'ipsec rekey storm' on device BRANCH-RTR1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.147.196.201", "event": "ipsec rekey storm", "severity": "critical"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected event 'snmp brute-force' on device EDGE-FW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.114.180.34", "event": "snmp brute-force", "severity": "critical"}, "requested_show": ["show snmp group", "show snmp user", "show logging | include SNMP"]}
{"instruction": "Wazuh detected event 'snmp brute-force' on device EDGE-FW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.220.66.140", "event": "snmp brute-force", "severity": "low"}, "requested_show": ["show logging | include SNMP", "show snmp user", "show snmp group"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device EDGE-FW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.232.65.60", "event": "dhcp starvation attack", "severity": "medium"}, "requested_show": ["show ip dhcp binding", "show mac address-table", "show ip dhcp conflict"]}
{"instruction": "Wazuh detected event 'port scan detected' on device ACCESS-SW2 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.25.61.5", "event": "port scan detected", "severity": "low"}, "requested_show": ["show logging | include DENY", "show firewall", "show access-lists", "show conn"]}
{"instruction": "Wazuh detected event 'lldp neighbor mismatch' on device ACCESS-SW2 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.201.99.26", "event": "lldp neighbor mismatch", "severity": "medium"}, "requested_show": ["show lldp neighbors detail", "show lldp neighbors"]}
{"instruction": "Wazuh detected event 'eigrp neighbor flap' on device ACCESS-SW2 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.55.244.73", "event": "eigrp neighbor flap", "severity": "low"}, "requested_show": ["show ip eigrp neighbors", "show ip eigrp topology"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device ACCESS-SW2 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.48.46.195", "event": "failed login attempts", "severity": "high"}, "requested_show": ["show ip ssh", "show logging | include LOGIN", "show users"]}
{"instruction": "Wazuh detected event 'firewall deny excessive' on device CORE-R1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.131.243.19", "event": "firewall deny excessive", "severity": "low"}, "requested_show": ["show access-lists", "show firewall", "show conn"]}
{"instruction": "Wazuh detected event 'broadcast storm detected' on device BRANCH-RTR1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.119.236.71", "event": "broadcast storm detected", "severity": "medium"}, "requested_show": ["show ip traffic", "show interfaces counters", "show mac address-table"]}
{"instruction": "Wazuh detected event 'mtu mismatch' on device CORE-R1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.211.111.148", "event": "mtu mismatch", "severity": "low"}, "requested_show": ["show interfaces", "show ip ospf interface"]}
{"instruction": "Wazuh detected event 'mac flapping detected' on device CORE-R1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.93.90.186", "event": "mac flapping detected", "severity": "critical"}, "requested_show": ["show mac address-table", "show mac address-table move", "show spanning-tree"]}
{"instruction": "Wazuh detected event 'blacklisted ip communication' on device EDGE-FW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.105.25.82", "event": "blacklisted ip communication", "severity": "high"}, "requested_show": ["show conn address", "show ip route", "show access-lists", "show logging | include DENY"]}
{"instruction": "Wazuh detected event 'ospf lsa flood' on device CORE-R1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.9.21.27", "event": "ospf lsa flood", "severity": "high"}, "requested_show": ["show ip ospf database", "show ip ospf"]}
{"instruction": "Wazuh detected event 'cdp rogue device' on device ACCESS-SW2 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.79.24.248", "event": "cdp rogue device", "severity": "critical"}, "requested_show": ["show cdp neighbors detail", "show cdp neighbors"]}
{"instruction": "Wazuh detected event 'blacklisted ip communication' on device BRANCH-RTR1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.202.123.214", "event": "blacklisted ip communication", "severity": "high"}, "requested_show": ["show conn address", "show access-lists", "show logging | include DENY", "show ip route"]}
{"instruction": "Wazuh detected event 'mtu mismatch' on device CORE-R1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.1.11.190", "event": "mtu mismatch", "severity": "low"}, "requested_show": ["show ip ospf interface", "show interfaces"]}
{"instruction": "Wazuh detected event 'packet loss detected' on device CORE-R1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.197.22.59", "event": "packet loss detected", "severity": "low"}, "requested_show": ["show interfaces counters errors", "show interfaces"]}
{"instruction": "Wazuh detected event 'stp loop detected' on device CORE-R1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.91.87.214", "event": "stp loop detected", "severity": "high"}, "requested_show": ["show spanning-tree detail", "show spanning-tree", "show mac address-table move"]}
{"instruction": "Wazuh detected event 'ddos high connection rate' on device CORE-R1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.247.86.92", "event": "ddos high connection rate", "severity": "critical"}, "requested_show": ["show ip traffic", "show interfaces counters", "show conn"]}
{"instruction": "Wazuh detected event 'static route mismatch' on device EDGE-FW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.198.224.96", "event": "static route mismatch", "severity": "critical"}, "requested_show": ["show ip route static", "show running-config | include ip route"]}
{"instruction": "Wazuh detected event 'lldp neighbor mismatch' on device EDGE-FW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.238.106.18", "event": "lldp neighbor mismatch", "severity": "low"}, "requested_show": ["show lldp neighbors", "show lldp neighbors detail"]}
{"instruction": "Wazuh detected event 'ssh brute-force' on device CORE-R1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.210.135.15", "event": "ssh brute-force", "severity": "high"}, "requested_show": ["show access-lists", "show ip ssh", "show users", "show logging | include SSH"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device ACCESS-SW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.122.254.212", "event": "vpn tunnel down", "severity": "critical"}, "requested_show": ["show crypto ipsec sa", "show interfaces", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected event 'ip conflict detected' on device BRANCH-RTR1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.14.74.160", "event": "ip conflict detected", "severity": "high"}, "requested_show": ["show arp", "show logging | include DUPLICATE", "show ip interface"]}
{"instruction": "Wazuh detected event 'tcp retransmissions high' on device CORE-R1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.106.70.143", "event": "tcp retransmissions high", "severity": "critical"}, "requested_show": ["show interfaces", "show ip tcp statistics", "show ip traffic"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device BRANCH-RTR1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.123.142.199", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show mac address-table", "show ip traffic", "show arp", "show ip verify source"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device EDGE-FW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.187.230.126", "event": "failed login attempts", "severity": "high"}, "requested_show": ["show ip ssh", "show logging | include LOGIN", "show users"]}
{"instruction": "Wazuh detected event 'subnet overlap detected' on device EDGE-FW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.0.182.53", "event": "subnet overlap detected", "severity": "critical"}, "requested_show": ["show ip route", "show running-config | include ip address"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device EDGE-FW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.222.247.40", "event": "high cpu usage", "severity": "medium"}, "requested_show": ["show processes cpu sorted", "show platform resources", "show memory statistics"]}
{"instruction": "Wazuh detected event 'ipsec rekey storm' on device ACCESS-SW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.65.165.31", "event": "ipsec rekey storm", "severity": "high"}, "requested_show": ["show crypto ipsec sa", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected event 'nat translation failure' on device EDGE-FW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.90.238.111", "event": "nat translation failure", "severity": "medium"}, "requested_show": ["show ip nat translations", "show ip nat statistics"]}
{"instruction": "Wazuh detected event 'ip conflict detected' on device CORE-R1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.10.253.79", "event": "ip conflict detected", "severity": "medium"}, "requested_show": ["show ip interface", "show logging | include DUPLICATE", "show arp"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device EDGE-FW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.24.31.235", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show ip ospf database", "show interfaces", "show ip ospf neighbor", "show ip ospf interface"]}
{"instruction": "Wazuh detected event 'ntp sync lost' on device ACCESS-SW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.59.65.177", "event": "ntp sync lost", "severity": "critical"}, "requested_show": ["show ntp status", "show clock", "show ntp associations"]}
{"instruction": "Wazuh detected event 'ospf lsa flood' on device CORE-R1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.179.11.143", "event": "ospf lsa flood", "severity": "high"}, "requested_show": ["show ip ospf database", "show ip ospf"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device CORE-R1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.60.122.6", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show ip ospf database", "show ip ospf interface", "show ip ospf neighbor", "show interfaces"]}
{"instruction": "Wazuh detected event 'ddos high connection rate' on device CORE-R1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.104.100.50", "event": "ddos high connection rate", "severity": "critical"}, "requested_show": ["show conn", "show interfaces counters", "show ip traffic"]}
{"instruction": "Wazuh detected event 'subnet overlap detected' on device CORE-R1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.170.21.2", "event": "subnet overlap detected", "severity": "medium"}, "requested_show": ["show ip route", "show running-config | include ip address"]}
{"instruction": "Wazuh detected event 'ntp sync lost' on device CORE-R1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.220.93.242", "event": "ntp sync lost", "severity": "high"}, "requested_show": ["show ntp status", "show ntp associations", "show clock"]}
{"instruction": "Wazuh detected event 'static route mismatch' on device ACCESS-SW2 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.54.122.19", "event": "static route mismatch", "severity": "critical"}, "requested_show": ["show ip route static", "show running-config | include ip route"]}
{"instruction": "Wazuh detected event 'mtu mismatch' on device CORE-R1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.110.7.154", "event": "mtu mismatch", "severity": "high"}, "requested_show": ["show ip ospf interface", "show interfaces"]}
{"instruction": "Wazuh detected event 'link duplex mismatch' on device ACCESS-SW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.247.139.253", "event": "link duplex mismatch", "severity": "critical"}, "requested_show": ["show interfaces", "show controllers"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device CORE-R1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.211.183.133", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show ip ospf interface", "show ip ospf neighbor", "show ip ospf database", "show interfaces"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device EDGE-FW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.26.61.224", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show interfaces", "show ip ospf neighbor", "show ip ospf database", "show ip ospf interface"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device CORE-R1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.81.196.209", "event": "arp spoofing suspected", "severity": "low"}, "requested_show": ["show ip traffic", "show ip verify source", "show arp", "show mac address-table"]}
{"instruction": "Wazuh detected event 'interface flapping' on device CORE-R1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.18.58.181", "event": "interface flapping", "severity": "high"}, "requested_show": ["show interfaces", "show logging | include LINK", "show interfaces status"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device ACCESS-SW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.96.143.184", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show ip ospf neighbor", "show ip ospf database", "show ip ospf interface", "show interfaces"]}
{"instruction": "Wazuh detected event 'firewall deny excessive' on device ACCESS-SW2 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.233.107.112", "event": "firewall deny excessive", "severity": "low"}, "requested_show": ["show conn", "show access-lists", "show firewall"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device BRANCH-RTR1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.135.163.199", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show ip ospf neighbor", "show ip ospf interface", "show interfaces", "show ip ospf database"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device BRANCH-RTR1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.110.41.73", "event": "dns exfiltration suspected", "severity": "critical"}, "requested_show": ["show ip traffic", "show logging | include DNS", "show ip dns view"]}
{"instruction": "Wazuh detected event 'firewall deny excessive' on device ACCESS-SW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.92.164.148", "event": "firewall deny excessive", "severity": "critical"}, "requested_show": ["show access-lists", "show firewall", "show conn"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device EDGE-FW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.87.218.11", "event": "failed login attempts", "severity": "low"}, "requested_show": ["show users", "show ip ssh", "show logging | include LOGIN"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device BRANCH-RTR1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.105.124.103", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show mac address-table", "show arp", "show ip verify source", "show ip traffic"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device CORE-R1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.125.54.70", "event": "dns exfiltration suspected", "severity": "medium"}, "requested_show": ["show ip traffic", "show logging | include DNS", "show ip dns view"]}
{"instruction": "Wazuh detected event 'memory leak suspected' on device ACCESS-SW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.168.205.174", "event": "memory leak suspected", "severity": "low"}, "requested_show": ["show processes memory sorted", "show memory statistics"]}
{"instruction": "Wazuh detected event 'nat translation failure' on device ACCESS-SW2 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.52.145.215", "event": "nat translation failure", "severity": "low"}, "requested_show": ["show ip nat translations", "show ip nat statistics"]}
{"instruction": "Wazuh detected event 'ddos high connection rate' on device CORE-R1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.2.209.27", "event": "ddos high connection rate", "severity": "low"}, "requested_show": ["show conn", "show interfaces counters", "show ip traffic"]}
{"instruction": "Wazuh detected event 'acl hitcount anomaly' on device ACCESS-SW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.150.191.93", "event": "acl hitcount anomaly", "severity": "critical"}, "requested_show": ["show access-lists | include hitcnt", "show access-lists"]}
{"instruction": "Wazuh detected event 'mac flapping detected' on device CORE-R1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.123.20.200", "event": "mac flapping detected", "severity": "medium"}, "requested_show": ["show mac address-table move", "show mac address-table", "show spanning-tree"]}
{"instruction": "Wazuh detected event 'vrf route leak' on device CORE-R1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.4.136.84", "event": "vrf route leak", "severity": "medium"}, "requested_show": ["show ip vrf", "show ip route vrf"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device CORE-R1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.245.210.164", "event": "high cpu usage", "severity": "medium"}, "requested_show": ["show platform resources", "show memory statistics", "show processes cpu sorted"]}
{"instruction": "Wazuh detected event 'nat translation failure' on device ACCESS-SW2 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.218.29.192", "event": "nat translation failure", "severity": "high"}, "requested_show": ["show ip nat translations", "show ip nat statistics"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device EDGE-FW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.148.29.44", "event": "failed login attempts", "severity": "high"}, "requested_show": ["show ip ssh", "show logging | include LOGIN", "show users"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device ACCESS-SW2 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.16.18.210", "event": "dhcp starvation attack", "severity": "critical"}, "requested_show": ["show mac address-table", "show ip dhcp binding", "show ip dhcp conflict"]}
{"instruction": "Wazuh detected event 'snmp brute-force' on device CORE-R1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.168.84.252", "event": "snmp brute-force", "severity": "low"}, "requested_show": ["show snmp group", "show snmp user", "show logging | include SNMP"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device CORE-R1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.224.252.146", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show crypto ipsec sa", "show interfaces", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected event 'memory leak suspected' on device EDGE-FW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.151.5.107", "event": "memory leak suspected", "severity": "low"}, "requested_show": ["show memory statistics", "show processes memory sorted"]}
{"instruction": "Wazuh detected event 'ntp sync lost' on device BRANCH-RTR1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.114.32.168", "event": "ntp sync lost", "severity": "low"}, "requested_show": ["show clock", "show ntp status", "show ntp associations"]}
{"instruction": "Wazuh detected event 'ip conflict detected' on device ACCESS-SW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.45.152.146", "event": "ip conflict detected", "severity": "critical"}, "requested_show": ["show ip interface", "show logging | include DUPLICATE", "show arp"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device CORE-R1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.92.53.218", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show ip traffic", "show arp", "show mac address-table", "show ip verify source"]}
{"instruction": "Wazuh detected event 'subnet overlap detected' on device EDGE-FW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.95.0.200", "event": "subnet overlap detected", "severity": "critical"}, "requested_show": ["show running-config | include ip address", "show ip route"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device BRANCH-RTR1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.8.138.5", "event": "high cpu usage", "severity": "medium"}, "requested_show": ["show processes cpu sorted", "show platform resources", "show memory statistics"]}
{"instruction": "Wazuh detected event 'mac flapping detected' on device ACCESS-SW2 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.246.251.198", "event": "mac flapping detected", "severity": "critical"}, "requested_show": ["show mac address-table move", "show mac address-table", "show spanning-tree"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device CORE-R1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.107.74.108", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show ip ospf database", "show interfaces", "show ip ospf neighbor", "show ip ospf interface"]}
{"instruction": "Wazuh detected event 'firewall deny excessive' on device EDGE-FW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.251.21.101", "event": "firewall deny excessive", "severity": "medium"}, "requested_show": ["show firewall", "show conn", "show access-lists"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device BRANCH-RTR1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.200.74.21", "event": "failed login attempts", "severity": "critical"}, "requested_show": ["show ip ssh", "show logging | include LOGIN", "show users"]}
{"instruction": "Wazuh detected event 'acl blocking legitimate traffic' on device EDGE-FW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.22.245.132", "event": "acl blocking legitimate traffic", "severity": "high"}, "requested_show": ["show access-lists", "show ip interface", "show logging | include DENY", "show ip route"]}
{"instruction": "Wazuh detected event 'blacklisted ip communication' on device CORE-R1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.10.151.218", "event": "blacklisted ip communication", "severity": "low"}, "requested_show": ["show conn address", "show ip route", "show access-lists", "show logging | include DENY"]}
{"instruction": "Wazuh detected event 'ddos high connection rate' on device ACCESS-SW2 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.47.37.9", "event": "ddos high connection rate", "severity": "high"}, "requested_show": ["show ip traffic", "show interfaces counters", "show conn"]}
{"instruction": "Wazuh detected event 'acl hitcount anomaly' on device BRANCH-RTR1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.188.55.97", "event": "acl hitcount anomaly", "severity": "medium"}, "requested_show": ["show access-lists | include hitcnt", "show access-lists"]}
{"instruction": "Wazuh detected event 'tcp retransmissions high' on device BRANCH-RTR1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.187.179.150", "event": "tcp retransmissions high", "severity": "critical"}, "requested_show": ["show ip traffic", "show ip tcp statistics", "show interfaces"]}
{"instruction": "Wazuh detected event 'port scan detected' on device CORE-R1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.21.2.182", "event": "port scan detected", "severity": "critical"}, "requested_show": ["show firewall", "show logging | include DENY", "show conn", "show ip traffic", "show access-lists"]}
{"instruction": "Wazuh detected event 'mac flapping detected' on device BRANCH-RTR1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.162.140.150", "event": "mac flapping detected", "severity": "low"}, "requested_show": ["show mac address-table", "show spanning-tree", "show mac address-table move"]}
{"instruction": "Wazuh detected event 'link duplex mismatch' on device EDGE-FW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.185.133.112", "event": "link duplex mismatch", "severity": "high"}, "requested_show": ["show controllers", "show interfaces"]}
{"instruction": "Wazuh detected event 'vlan mismatch detected' on device BRANCH-RTR1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.72.166.246", "event": "vlan mismatch detected", "severity": "critical"}, "requested_show": ["show interfaces trunk", "show vlan brief"]}
{"instruction": "Wazuh detected event 'vrf route leak' on device BRANCH-RTR1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.201.57.53", "event": "vrf route leak", "severity": "critical"}, "requested_show": ["show ip route vrf", "show ip vrf"]}
{"instruction": "Wazuh detected event 'snmp brute-force' on device ACCESS-SW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.109.254.114", "event": "snmp brute-force", "severity": "high"}, "requested_show": ["show logging | include SNMP", "show snmp group", "show snmp user"]}
{"instruction": "Wazuh detected event 'memory leak suspected' on device EDGE-FW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.33.108.83", "event": "memory leak suspected", "severity": "medium"}, "requested_show": ["show memory statistics", "show processes memory sorted"]}
{"instruction": "Wazuh detected event 'syslog flood detected' on device ACCESS-SW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.181.245.95", "event": "syslog flood detected", "severity": "high"}, "requested_show": ["show logging", "show ip traffic", "show interfaces counters"]}
{"instruction": "Wazuh detected event 'ip conflict detected' on device ACCESS-SW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.112.27.133", "event": "ip conflict detected", "severity": "low"}, "requested_show": ["show ip interface", "show logging | include DUPLICATE", "show arp"]}
{"instruction": "Wazuh detected event 'ospf lsa flood' on device ACCESS-SW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.7.223.199", "event": "ospf lsa flood", "severity": "critical"}, "requested_show": ["show ip ospf", "show ip ospf database"]}
{"instruction": "Wazuh detected event 'ipsec rekey storm' on device ACCESS-SW2 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.186.177.242", "event": "ipsec rekey storm", "severity": "critical"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected event 'eigrp neighbor flap' on device CORE-R1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.81.175.145", "event": "eigrp neighbor flap", "severity": "critical"}, "requested_show": ["show ip eigrp topology", "show ip eigrp neighbors"]}
{"instruction": "Wazuh detected event 'acl hitcount anomaly' on device CORE-R1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.166.133.125", "event": "acl hitcount anomaly", "severity": "critical"}, "requested_show": ["show access-lists", "show access-lists | include hitcnt"]}
{"instruction": "Wazuh detected event 'interface flapping' on device CORE-R1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.181.229.220", "event": "interface flapping", "severity": "medium"}, "requested_show": ["show interfaces", "show logging | include LINK", "show interfaces status"]}
{"instruction": "Wazuh detected event 'packet loss detected' on device BRANCH-RTR1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.255.219.118", "event": "packet loss detected", "severity": "low"}, "requested_show": ["show interfaces", "show interfaces counters errors"]}
{"instruction": "Wazuh detected event 'memory leak suspected' on device ACCESS-SW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.211.41.230", "event": "memory leak suspected", "severity": "high"}, "requested_show": ["show processes memory sorted", "show memory statistics"]}
{"instruction": "Wazuh detected event 'bgp session flap' on device BRANCH-RTR1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.157.47.146", "event": "bgp session flap", "severity": "low"}, "requested_show": ["show ip bgp summary", "show ip bgp neighbors", "show logging | include BGP", "show ip route"]}
{"instruction": "Wazuh detected event 'ipsec rekey storm' on device CORE-R1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.117.94.221", "event": "ipsec rekey storm", "severity": "medium"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected event 'subnet overlap detected' on device ACCESS-SW2 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.174.65.75", "event": "subnet overlap detected", "severity": "medium"}, "requested_show": ["show running-config | include ip address", "show ip route"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device BRANCH-RTR1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.90.185.60", "event": "dns exfiltration suspected", "severity": "high"}, "requested_show": ["show ip dns view", "show ip traffic", "show logging | include DNS"]}
{"instruction": "Wazuh detected event 'ddos high connection rate' on device ACCESS-SW2 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.83.79.252", "event": "ddos high connection rate", "severity": "medium"}, "requested_show": ["show interfaces counters", "show ip traffic", "show conn"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device EDGE-FW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.127.251.76", "event": "vpn tunnel down", "severity": "low"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa", "show interfaces"]}
{"instruction": "Wazuh detected event 'memory leak suspected' on device ACCESS-SW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.97.118.103", "event": "memory leak suspected", "severity": "critical"}, "requested_show": ["show processes memory sorted", "show memory statistics"]}
{"instruction": "Wazuh detected event 'port scan detected' on device ACCESS-SW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.246.249.140", "event": "port scan detected", "severity": "high"}, "requested_show": ["show ip traffic", "show access-lists", "show conn", "show firewall", "show logging | include DENY"]}
{"instruction": "Wazuh detected event 'syslog flood detected' on device BRANCH-RTR1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.153.152.250", "event": "syslog flood detected", "severity": "critical"}, "requested_show": ["show ip traffic", "show interfaces counters", "show logging"]}
{"instruction": "Wazuh detected event 'eigrp neighbor flap' on device CORE-R1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.10.206.100", "event": "eigrp neighbor flap", "severity": "critical"}, "requested_show": ["show ip eigrp topology", "show ip eigrp neighbors"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device BRANCH-RTR1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.192.28.91", "event": "failed login attempts", "severity": "low"}, "requested_show": ["show users", "show logging | include LOGIN", "show ip ssh"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device CORE-R1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.226.175.171", "event": "arp spoofing suspected", "severity": "critical"}, "requested_show": ["show ip verify source", "show arp", "show ip traffic", "show mac address-table"]}
{"instruction": "Wazuh detected event 'ospf lsa flood' on device ACCESS-SW2 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.197.160.230", "event": "ospf lsa flood", "severity": "medium"}, "requested_show": ["show ip ospf database", "show ip ospf"]}
{"instruction": "Wazuh detected event 'ddos high connection rate' on device ACCESS-SW2 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.186.152.30", "event": "ddos high connection rate", "severity": "medium"}, "requested_show": ["show interfaces counters", "show ip traffic", "show conn"]}
{"instruction": "Wazuh detected event 'memory leak suspected' on device ACCESS-SW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.213.88.149", "event": "memory leak suspected", "severity": "medium"}, "requested_show": ["show memory statistics", "show processes memory sorted"]}
{"instruction": "Wazuh detected event 'acl hitcount anomaly' on device CORE-R1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.108.184.232", "event": "acl hitcount anomaly", "severity": "low"}, "requested_show": ["show access-lists", "show access-lists | include hitcnt"]}
{"instruction": "Wazuh detected event 'eigrp neighbor flap' on device EDGE-FW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.14.49.128", "event": "eigrp neighbor flap", "severity": "low"}, "requested_show": ["show ip eigrp topology", "show ip eigrp neighbors"]}
{"instruction": "Wazuh detected event 'ip conflict detected' on device ACCESS-SW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.32.191.159", "event": "ip conflict detected", "severity": "high"}, "requested_show": ["show logging | include DUPLICATE", "show arp", "show ip interface"]}
{"instruction": "Wazuh detected event 'vrf route leak' on device BRANCH-RTR1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.44.184.183", "event": "vrf route leak", "severity": "high"}, "requested_show": ["show ip vrf", "show ip route vrf"]}
{"instruction": "Wazuh detected event 'bgp session flap' on device EDGE-FW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.197.11.209", "event": "bgp session flap", "severity": "medium"}, "requested_show": ["show ip route", "show ip bgp summary", "show logging | include BGP", "show ip bgp neighbors"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device ACCESS-SW2 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.235.36.51", "event": "dns exfiltration suspected", "severity": "low"}, "requested_show": ["show ip traffic", "show logging | include DNS", "show ip dns view"]}
{"instruction": "Wazuh detected event 'syslog flood detected' on device BRANCH-RTR1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.216.213.249", "event": "syslog flood detected", "severity": "medium"}, "requested_show": ["show interfaces counters", "show logging", "show ip traffic"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device EDGE-FW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.158.248.4", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show mac address-table", "show ip verify source", "show ip traffic", "show arp"]}
{"instruction": "Wazuh detected event 'acl blocking legitimate traffic' on device CORE-R1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.181.46.200", "event": "acl blocking legitimate traffic", "severity": "critical"}, "requested_show": ["show ip interface", "show logging | include DENY", "show ip route", "show access-lists"]}
{"instruction": "Wazuh detected event 'syslog flood detected' on device CORE-R1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.1.151.225", "event": "syslog flood detected", "severity": "medium"}, "requested_show": ["show ip traffic", "show interfaces counters", "show logging"]}
{"instruction": "Wazuh detected event 'port scan detected' on device CORE-R1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.251.97.58", "event": "port scan detected", "severity": "medium"}, "requested_show": ["show access-lists", "show logging | include DENY", "show ip traffic", "show firewall", "show conn"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device ACCESS-SW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.72.145.118", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show arp", "show ip verify source", "show mac address-table", "show ip traffic"]}
{"instruction": "Wazuh detected event 'interface flapping' on device CORE-R1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.35.221.22", "event": "interface flapping", "severity": "medium"}, "requested_show": ["show interfaces", "show interfaces status", "show logging | include LINK"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device EDGE-FW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.47.203.220", "event": "dhcp starvation attack", "severity": "medium"}, "requested_show": ["show ip dhcp binding", "show ip dhcp conflict", "show mac address-table"]}
{"instruction": "Wazuh detected event 'link duplex mismatch' on device EDGE-FW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.139.29.26", "event": "link duplex mismatch", "severity": "medium"}, "requested_show": ["show controllers", "show interfaces"]}
{"instruction": "Wazuh detected event 'eigrp neighbor flap' on device CORE-R1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.77.86.228", "event": "eigrp neighbor flap", "severity": "high"}, "requested_show": ["show ip eigrp neighbors", "show ip eigrp topology"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device ACCESS-SW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.181.146.225", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show ip ospf interface", "show ip ospf neighbor", "show ip ospf database", "show interfaces"]}
{"instruction": "Wazuh detected event 'interface flapping' on device ACCESS-SW2 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.223.65.237", "event": "interface flapping", "severity": "low"}, "requested_show": ["show logging | include LINK", "show interfaces", "show interfaces status"]}
{"instruction": "Wazuh detected event 'packet loss detected' on device ACCESS-SW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.133.77.158", "event": "packet loss detected", "severity": "low"}, "requested_show": ["show interfaces", "show interfaces counters errors"]}
{"instruction": "Wazuh detected event 'ddos high connection rate' on device BRANCH-RTR1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.206.39.20", "event": "ddos high connection rate", "severity": "low"}, "requested_show": ["show ip traffic", "show interfaces counters", "show conn"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device EDGE-FW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.48.92.27", "event": "failed login attempts", "severity": "medium"}, "requested_show": ["show ip ssh", "show logging | include LOGIN", "show users"]}
{"instruction": "Wazuh detected event 'ip conflict detected' on device CORE-R1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.209.13.27", "event": "ip conflict detected", "severity": "medium"}, "requested_show": ["show logging | include DUPLICATE", "show ip interface", "show arp"]}
{"instruction": "Wazuh detected event 'tcp retransmissions high' on device CORE-R1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.128.64.127", "event": "tcp retransmissions high", "severity": "medium"}, "requested_show": ["show ip tcp statistics", "show interfaces", "show ip traffic"]}
{"instruction": "Wazuh detected event 'cdp rogue device' on device ACCESS-SW2 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.247.36.20", "event": "cdp rogue device", "severity": "critical"}, "requested_show": ["show cdp neighbors", "show cdp neighbors detail"]}
{"instruction": "Wazuh detected event 'eigrp neighbor flap' on device CORE-R1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.197.36.198", "event": "eigrp neighbor flap", "severity": "critical"}, "requested_show": ["show ip eigrp topology", "show ip eigrp neighbors"]}
{"instruction": "Wazuh detected event 'stp loop detected' on device ACCESS-SW2 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.45.67.164", "event": "stp loop detected", "severity": "medium"}, "requested_show": ["show spanning-tree", "show spanning-tree detail", "show mac address-table move"]}
{"instruction": "Wazuh detected event 'bgp session flap' on device ACCESS-SW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.87.255.183", "event": "bgp session flap", "severity": "high"}, "requested_show": ["show ip bgp summary", "show logging | include BGP", "show ip bgp neighbors", "show ip route"]}
{"instruction": "Wazuh detected event 'ospf lsa flood' on device BRANCH-RTR1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.245.169.56", "event": "ospf lsa flood", "severity": "high"}, "requested_show": ["show ip ospf", "show ip ospf database"]}
{"instruction": "Wazuh detected event 'packet loss detected' on device EDGE-FW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.238.186.186", "event": "packet loss detected", "severity": "high"}, "requested_show": ["show interfaces", "show interfaces counters errors"]}
{"instruction": "Wazuh detected event 'acl blocking legitimate traffic' on device ACCESS-SW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.77.67.42", "event": "acl blocking legitimate traffic", "severity": "high"}, "requested_show": ["show access-lists", "show ip route", "show logging | include DENY", "show ip interface"]}
{"instruction": "Wazuh detected event 'mtu mismatch' on device EDGE-FW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.180.212.177", "event": "mtu mismatch", "severity": "medium"}, "requested_show": ["show interfaces", "show ip ospf interface"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device CORE-R1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.103.87.54", "event": "high cpu usage", "severity": "medium"}, "requested_show": ["show memory statistics", "show platform resources", "show processes cpu sorted"]}
{"instruction": "Wazuh detected event 'eigrp neighbor flap' on device ACCESS-SW2 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.185.68.208", "event": "eigrp neighbor flap", "severity": "high"}, "requested_show": ["show ip eigrp topology", "show ip eigrp neighbors"]}
{"instruction": "Wazuh detected event 'port scan detected' on device BRANCH-RTR1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.239.201.175", "event": "port scan detected", "severity": "low"}, "requested_show": ["show conn", "show access-lists", "show firewall", "show logging | include DENY"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device CORE-R1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.60.225.158", "event": "dhcp starvation attack", "severity": "high"}, "requested_show": ["show ip dhcp conflict", "show ip dhcp binding", "show mac address-table"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device BRANCH-RTR1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.235.137.31", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show mac address-table", "show ip traffic", "show ip verify source", "show arp"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device ACCESS-SW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.254.248.54", "event": "dns exfiltration suspected", "severity": "critical"}, "requested_show": ["show ip traffic", "show logging | include DNS", "show ip dns view"]}
{"instruction": "Wazuh detected event 'nat translation failure' on device ACCESS-SW2 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.129.137.181", "event": "nat translation failure", "severity": "medium"}, "requested_show": ["show ip nat translations", "show ip nat statistics"]}
{"instruction": "Wazuh detected event 'ospf lsa flood' on device EDGE-FW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.177.255.178", "event": "ospf lsa flood", "severity": "high"}, "requested_show": ["show ip ospf database", "show ip ospf"]}
{"instruction": "Wazuh detected event 'ddos high connection rate' on device CORE-R1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.250.95.239", "event": "ddos high connection rate", "severity": "critical"}, "requested_show": ["show conn", "show ip traffic", "show interfaces counters"]}
{"instruction": "Wazuh detected event 'ntp sync lost' on device ACCESS-SW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.162.141.50", "event": "ntp sync lost", "severity": "medium"}, "requested_show": ["show ntp status", "show clock", "show ntp associations"]}
{"instruction": "Wazuh detected event 'tcp retransmissions high' on device EDGE-FW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.9.206.178", "event": "tcp retransmissions high", "severity": "medium"}, "requested_show": ["show ip traffic", "show interfaces", "show ip tcp statistics"]}
{"instruction": "Wazuh detected event 'bgp route leak suspected' on device ACCESS-SW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.68.142.62", "event": "bgp route leak suspected", "severity": "critical"}, "requested_show": ["show ip route", "show ip bgp neighbors", "show ip bgp"]}
{"instruction": "Wazuh detected event 'acl hitcount anomaly' on device ACCESS-SW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.173.59.182", "event": "acl hitcount anomaly", "severity": "high"}, "requested_show": ["show access-lists | include hitcnt", "show access-lists"]}
{"instruction": "Wazuh detected event 'ddos high connection rate' on device ACCESS-SW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.241.33.171", "event": "ddos high connection rate", "severity": "critical"}, "requested_show": ["show interfaces counters", "show conn", "show ip traffic"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device BRANCH-RTR1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.179.80.123", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show arp", "show mac address-table", "show ip traffic", "show ip verify source"]}
{"instruction": "Wazuh detected event 'bgp route leak suspected' on device CORE-R1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.13.91.165", "event": "bgp route leak suspected", "severity": "high"}, "requested_show": ["show ip bgp neighbors", "show ip bgp", "show ip route"]}
{"instruction": "Wazuh detected event 'syslog flood detected' on device BRANCH-RTR1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.221.40.240", "event": "syslog flood detected", "severity": "low"}, "requested_show": ["show logging", "show interfaces counters", "show ip traffic"]}
{"instruction": "Wazuh detected event 'mtu mismatch' on device EDGE-FW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.81.219.56", "event": "mtu mismatch", "severity": "high"}, "requested_show": ["show interfaces", "show ip ospf interface"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device ACCESS-SW2 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.86.153.40", "event": "dhcp starvation attack", "severity": "low"}, "requested_show": ["show mac address-table", "show ip dhcp conflict", "show ip dhcp binding"]}
{"instruction": "Wazuh detected event 'interface flapping' on device ACCESS-SW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.95.21.52", "event": "interface flapping", "severity": "high"}, "requested_show": ["show logging | include LINK", "show interfaces", "show interfaces status"]}
{"instruction": "Wazuh detected event 'acl hitcount anomaly' on device ACCESS-SW2 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.42.193.171", "event": "acl hitcount anomaly", "severity": "critical"}, "requested_show": ["show access-lists | include hitcnt", "show access-lists"]}
{"instruction": "Wazuh detected event 'acl hitcount anomaly' on device BRANCH-RTR1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.227.76.215", "event": "acl hitcount anomaly", "severity": "high"}, "requested_show": ["show access-lists | include hitcnt", "show access-lists"]}
{"instruction": "Wazuh detected event 'mac flapping detected' on device BRANCH-RTR1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.149.110.129", "event": "mac flapping detected", "severity": "medium"}, "requested_show": ["show mac address-table", "show mac address-table move", "show spanning-tree"]}
{"instruction": "Wazuh detected event 'mac flapping detected' on device BRANCH-RTR1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.60.191.53", "event": "mac flapping detected", "severity": "high"}, "requested_show": ["show mac address-table", "show spanning-tree", "show mac address-table move"]}
{"instruction": "Wazuh detected event 'dhcp starvation attack' on device EDGE-FW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.133.89.43", "event": "dhcp starvation attack", "severity": "medium"}, "requested_show": ["show mac address-table", "show ip dhcp binding", "show ip dhcp conflict"]}
{"instruction": "Wazuh detected event 'ntp sync lost' on device ACCESS-SW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.91.46.26", "event": "ntp sync lost", "severity": "high"}, "requested_show": ["show clock", "show ntp status", "show ntp associations"]}
{"instruction": "Wazuh detected event 'ip conflict detected' on device EDGE-FW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.160.250.58", "event": "ip conflict detected", "severity": "high"}, "requested_show": ["show ip interface", "show logging | include DUPLICATE", "show arp"]}
{"instruction": "Wazuh detected event 'static route mismatch' on device EDGE-FW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.196.58.137", "event": "static route mismatch", "severity": "low"}, "requested_show": ["show ip route static", "show running-config | include ip route"]}
{"instruction": "Wazuh detected event 'stp loop detected' on device BRANCH-RTR1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.212.149.101", "event": "stp loop detected", "severity": "critical"}, "requested_show": ["show spanning-tree detail", "show spanning-tree", "show mac address-table move"]}
{"instruction": "Wazuh detected event 'subnet overlap detected' on device ACCESS-SW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.82.248.216", "event": "subnet overlap detected", "severity": "medium"}, "requested_show": ["show ip route", "show running-config | include ip address"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device ACCESS-SW2 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.9.242.207", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show arp", "show ip verify source", "show mac address-table", "show ip traffic"]}
{"instruction": "Wazuh detected event 'link duplex mismatch' on device CORE-R1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.40.158.6", "event": "link duplex mismatch", "severity": "critical"}, "requested_show": ["show controllers", "show interfaces"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device EDGE-FW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.155.130.68", "event": "vpn tunnel down", "severity": "medium"}, "requested_show": ["show crypto ikev2 sa", "show interfaces", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected event 'firewall deny excessive' on device ACCESS-SW2 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.177.171.103", "event": "firewall deny excessive", "severity": "medium"}, "requested_show": ["show access-lists", "show firewall", "show conn"]}
{"instruction": "Wazuh detected event 'ntp sync lost' on device ACCESS-SW2 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.135.49.203", "event": "ntp sync lost", "severity": "low"}, "requested_show": ["show clock", "show ntp associations", "show ntp status"]}
{"instruction": "Wazuh detected event 'nat translation failure' on device EDGE-FW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.141.75.193", "event": "nat translation failure", "severity": "medium"}, "requested_show": ["show ip nat statistics", "show ip nat translations"]}
{"instruction": "Wazuh detected event 'ip conflict detected' on device EDGE-FW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.26.139.203", "event": "ip conflict detected", "severity": "low"}, "requested_show": ["show logging | include DUPLICATE", "show ip interface", "show arp"]}
{"instruction": "Wazuh detected event 'broadcast storm detected' on device CORE-R1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.135.11.39", "event": "broadcast storm detected", "severity": "low"}, "requested_show": ["show ip traffic", "show interfaces counters", "show mac address-table"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device ACCESS-SW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.216.109.86", "event": "ospf neighbor down", "severity": "high"}, "requested_show": ["show ip ospf neighbor", "show interfaces", "show ip ospf database", "show ip ospf interface"]}
{"instruction": "Wazuh detected event 'memory leak suspected' on device CORE-R1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.192.159.223", "event": "memory leak suspected", "severity": "medium"}, "requested_show": ["show memory statistics", "show processes memory sorted"]}
{"instruction": "Wazuh detected event 'memory leak suspected' on device BRANCH-RTR1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.70.103.39", "event": "memory leak suspected", "severity": "low"}, "requested_show": ["show memory statistics", "show processes memory sorted"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device ACCESS-SW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.99.145.78", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show memory statistics", "show processes cpu sorted", "show platform resources"]}
{"instruction": "Wazuh detected event 'acl blocking legitimate traffic' on device ACCESS-SW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.94.60.229", "event": "acl blocking legitimate traffic", "severity": "high"}, "requested_show": ["show logging | include DENY", "show ip route", "show access-lists", "show ip interface"]}
{"instruction": "Wazuh detected event 'bgp session flap' on device ACCESS-SW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.230.31.125", "event": "bgp session flap", "severity": "low"}, "requested_show": ["show logging | include BGP", "show ip route", "show ip bgp neighbors", "show ip bgp summary"]}
{"instruction": "Wazuh detected event 'ipsec rekey storm' on device EDGE-FW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.18.231.231", "event": "ipsec rekey storm", "severity": "medium"}, "requested_show": ["show crypto ipsec sa", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected event 'mtu mismatch' on device EDGE-FW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.82.149.16", "event": "mtu mismatch", "severity": "medium"}, "requested_show": ["show interfaces", "show ip ospf interface"]}
{"instruction": "Wazuh detected event 'nat translation failure' on device EDGE-FW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.23.20.218", "event": "nat translation failure", "severity": "high"}, "requested_show": ["show ip nat translations", "show ip nat statistics"]}
{"instruction": "Wazuh detected event 'interface flapping' on device ACCESS-SW2 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.243.158.42", "event": "interface flapping", "severity": "high"}, "requested_show": ["show logging | include LINK", "show interfaces status", "show interfaces"]}
{"instruction": "Wazuh detected event 'ddos high connection rate' on device CORE-R1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.115.188.230", "event": "ddos high connection rate", "severity": "high"}, "requested_show": ["show conn", "show ip traffic", "show interfaces counters"]}
{"instruction": "Wazuh detected event 'interface flapping' on device ACCESS-SW2 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.157.96.203", "event": "interface flapping", "severity": "high"}, "requested_show": ["show interfaces", "show interfaces status", "show logging | include LINK"]}
{"instruction": "Wazuh detected event 'lldp neighbor mismatch' on device ACCESS-SW2 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.44.196.132", "event": "lldp neighbor mismatch", "severity": "high"}, "requested_show": ["show lldp neighbors", "show lldp neighbors detail"]}
{"instruction": "Wazuh detected event 'static route mismatch' on device CORE-R1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.183.191.72", "event": "static route mismatch", "severity": "medium"}, "requested_show": ["show running-config | include ip route", "show ip route static"]}
{"instruction": "Wazuh detected event 'ospf lsa flood' on device ACCESS-SW2 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.248.216.219", "event": "ospf lsa flood", "severity": "medium"}, "requested_show": ["show ip ospf", "show ip ospf database"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device ACCESS-SW2 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.140.163.59", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show interfaces", "show ip ospf interface", "show ip ospf neighbor", "show ip ospf database"]}
{"instruction": "Wazuh detected event 'acl hitcount anomaly' on device CORE-R1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.2.144.89", "event": "acl hitcount anomaly", "severity": "medium"}, "requested_show": ["show access-lists", "show access-lists | include hitcnt"]}
{"instruction": "Wazuh detected event 'link duplex mismatch' on device ACCESS-SW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.251.191.2", "event": "link duplex mismatch", "severity": "critical"}, "requested_show": ["show controllers", "show interfaces"]}
{"instruction": "Wazuh detected event 'acl blocking legitimate traffic' on device ACCESS-SW2 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.31.169.113", "event": "acl blocking legitimate traffic", "severity": "high"}, "requested_show": ["show ip route", "show access-lists", "show ip interface", "show logging | include DENY"]}
{"instruction": "Wazuh detected event 'snmp brute-force' on device EDGE-FW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.184.169.237", "event": "snmp brute-force", "severity": "low"}, "requested_show": ["show snmp group", "show logging | include SNMP", "show snmp user"]}
{"instruction": "Wazuh detected event 'mtu mismatch' on device CORE-R1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.31.126.92", "event": "mtu mismatch", "severity": "high"}, "requested_show": ["show ip ospf interface", "show interfaces"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device CORE-R1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.6.155.234", "event": "failed login attempts", "severity": "low"}, "requested_show": ["show users", "show ip ssh", "show logging | include LOGIN"]}
{"instruction": "Wazuh detected event 'nat translation failure' on device ACCESS-SW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.133.233.30", "event": "nat translation failure", "severity": "critical"}, "requested_show": ["show ip nat statistics", "show ip nat translations"]}
{"instruction": "Wazuh detected event 'bgp route leak suspected' on device BRANCH-RTR1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.71.167.37", "event": "bgp route leak suspected", "severity": "medium"}, "requested_show": ["show ip bgp neighbors", "show ip bgp", "show ip route"]}
{"instruction": "Wazuh detected event 'firewall deny excessive' on device ACCESS-SW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.51.112.100", "event": "firewall deny excessive", "severity": "medium"}, "requested_show": ["show firewall", "show access-lists", "show conn"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device ACCESS-SW2 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.231.119.78", "event": "failed login attempts", "severity": "low"}, "requested_show": ["show users", "show logging | include LOGIN", "show ip ssh"]}
{"instruction": "Wazuh detected event 'static route mismatch' on device EDGE-FW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.88.77.47", "event": "static route mismatch", "severity": "critical"}, "requested_show": ["show ip route static", "show running-config | include ip route"]}
{"instruction": "Wazuh detected event 'firewall deny excessive' on device ACCESS-SW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.71.26.211", "event": "firewall deny excessive", "severity": "medium"}, "requested_show": ["show firewall", "show conn", "show access-lists"]}
{"instruction": "Wazuh detected event 'snmp brute-force' on device EDGE-FW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.123.88.8", "event": "snmp brute-force", "severity": "medium"}, "requested_show": ["show logging | include SNMP", "show snmp user", "show snmp group"]}
{"instruction": "Wazuh detected event 'lldp neighbor mismatch' on device ACCESS-SW2 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.215.0.194", "event": "lldp neighbor mismatch", "severity": "medium"}, "requested_show": ["show lldp neighbors", "show lldp neighbors detail"]}
{"instruction": "Wazuh detected event 'tcp retransmissions high' on device ACCESS-SW2 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.168.2.165", "event": "tcp retransmissions high", "severity": "critical"}, "requested_show": ["show ip traffic", "show interfaces", "show ip tcp statistics"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device ACCESS-SW2 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.201.138.142", "event": "vpn tunnel down", "severity": "critical"}, "requested_show": ["show interfaces", "show crypto ipsec sa", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device ACCESS-SW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.37.165.116", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show ip ospf database", "show interfaces", "show ip ospf neighbor", "show ip ospf interface"]}
{"instruction": "Wazuh detected event 'ssh brute-force' on device BRANCH-RTR1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.150.46.81", "event": "ssh brute-force", "severity": "low"}, "requested_show": ["show ip interface brief", "show logging | include SSH", "show access-lists", "show users"]}
{"instruction": "Wazuh detected event 'bgp session flap' on device ACCESS-SW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.38.63.162", "event": "bgp session flap", "severity": "critical"}, "requested_show": ["show ip bgp summary", "show logging | include BGP", "show ip bgp neighbors", "show ip route"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device EDGE-FW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.45.1.55", "event": "arp spoofing suspected", "severity": "medium"}, "requested_show": ["show ip verify source", "show mac address-table", "show ip traffic", "show arp"]}
{"instruction": "Wazuh detected event 'port scan detected' on device EDGE-FW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.94.243.55", "event": "port scan detected", "severity": "critical"}, "requested_show": ["show conn", "show firewall", "show access-lists", "show logging | include DENY"]}
{"instruction": "Wazuh detected event 'syslog flood detected' on device ACCESS-SW2 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.149.43.2", "event": "syslog flood detected", "severity": "low"}, "requested_show": ["show logging", "show interfaces counters", "show ip traffic"]}
{"instruction": "Wazuh detected event 'link duplex mismatch' on device ACCESS-SW2 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.18.103.108", "event": "link duplex mismatch", "severity": "medium"}, "requested_show": ["show interfaces", "show controllers"]}
{"instruction": "Wazuh detected event 'ssh brute-force' on device CORE-R1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.100.18.6", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show access-lists", "show ip ssh", "show users", "show ip interface brief", "show logging | include SSH"]}
{"instruction": "Wazuh detected event 'mtu mismatch' on device BRANCH-RTR1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.189.124.177", "event": "mtu mismatch", "severity": "high"}, "requested_show": ["show interfaces", "show ip ospf interface"]}
{"instruction": "Wazuh detected event 'mac flapping detected' on device BRANCH-RTR1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.182.73.80", "event": "mac flapping detected", "severity": "high"}, "requested_show": ["show mac address-table move", "show mac address-table", "show spanning-tree"]}
{"instruction": "Wazuh detected event 'packet loss detected' on device EDGE-FW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.72.126.233", "event": "packet loss detected", "severity": "medium"}, "requested_show": ["show interfaces counters errors", "show interfaces"]}
{"instruction": "Wazuh detected event 'link duplex mismatch' on device EDGE-FW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.155.15.1", "event": "link duplex mismatch", "severity": "medium"}, "requested_show": ["show controllers", "show interfaces"]}
{"instruction": "Wazuh detected event 'vrf route leak' on device EDGE-FW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.231.7.244", "event": "vrf route leak", "severity": "high"}, "requested_show": ["show ip vrf", "show ip route vrf"]}
{"instruction": "Wazuh detected event 'broadcast storm detected' on device EDGE-FW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.47.191.71", "event": "broadcast storm detected", "severity": "critical"}, "requested_show": ["show ip traffic", "show interfaces counters", "show mac address-table"]}
{"instruction": "Wazuh detected event 'static route mismatch' on device ACCESS-SW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.50.229.85", "event": "static route mismatch", "severity": "high"}, "requested_show": ["show ip route static", "show running-config | include ip route"]}
{"instruction": "Wazuh detected event 'subnet overlap detected' on device BRANCH-RTR1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.246.71.41", "event": "subnet overlap detected", "severity": "low"}, "requested_show": ["show ip route", "show running-config | include ip address"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device BRANCH-RTR1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.60.125.155", "event": "arp spoofing suspected", "severity": "critical"}, "requested_show": ["show arp", "show ip verify source", "show mac address-table", "show ip traffic"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device ACCESS-SW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.65.216.199", "event": "ospf neighbor down", "severity": "low"}, "requested_show": ["show interfaces", "show ip ospf neighbor", "show ip ospf database", "show ip ospf interface"]}
{"instruction": "Wazuh detected event 'snmp brute-force' on device CORE-R1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.46.246.19", "event": "snmp brute-force", "severity": "critical"}, "requested_show": ["show snmp user", "show logging | include SNMP", "show snmp group"]}
{"instruction": "Wazuh detected event 'ospf lsa flood' on device EDGE-FW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.72.160.123", "event": "ospf lsa flood", "severity": "medium"}, "requested_show": ["show ip ospf", "show ip ospf database"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device ACCESS-SW2 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.8.129.19", "event": "arp spoofing suspected", "severity": "low"}, "requested_show": ["show ip verify source", "show ip traffic", "show mac address-table", "show arp"]}
{"instruction": "Wazuh detected event 'ospf neighbor down' on device BRANCH-RTR1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.107.86.172", "event": "ospf neighbor down", "severity": "critical"}, "requested_show": ["show ip ospf database", "show ip ospf neighbor", "show ip ospf interface", "show interfaces"]}
{"instruction": "Wazuh detected event 'firewall deny excessive' on device ACCESS-SW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.66.36.35", "event": "firewall deny excessive", "severity": "low"}, "requested_show": ["show access-lists", "show firewall", "show conn"]}
{"instruction": "Wazuh detected event 'ntp sync lost' on device EDGE-FW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.204.73.128", "event": "ntp sync lost", "severity": "high"}, "requested_show": ["show clock", "show ntp status", "show ntp associations"]}
{"instruction": "Wazuh detected event 'port scan detected' on device ACCESS-SW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.36.56.145", "event": "port scan detected", "severity": "medium"}, "requested_show": ["show conn", "show ip traffic", "show firewall", "show logging | include DENY"]}
{"instruction": "Wazuh detected event 'mac flapping detected' on device EDGE-FW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.62.110.149", "event": "mac flapping detected", "severity": "low"}, "requested_show": ["show mac address-table move", "show spanning-tree", "show mac address-table"]}
{"instruction": "Wazuh detected event 'tcp retransmissions high' on device ACCESS-SW2 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.98.144.200", "event": "tcp retransmissions high", "severity": "medium"}, "requested_show": ["show ip traffic", "show interfaces", "show ip tcp statistics"]}
{"instruction": "Wazuh detected event 'ntp sync lost' on device ACCESS-SW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.112.166.179", "event": "ntp sync lost", "severity": "critical"}, "requested_show": ["show clock", "show ntp status", "show ntp associations"]}
{"instruction": "Wazuh detected event 'packet loss detected' on device CORE-R1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.134.203.99", "event": "packet loss detected", "severity": "low"}, "requested_show": ["show interfaces", "show interfaces counters errors"]}
{"instruction": "Wazuh detected event 'interface flapping' on device ACCESS-SW2 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.188.152.170", "event": "interface flapping", "severity": "high"}, "requested_show": ["show interfaces status", "show logging | include LINK", "show interfaces"]}
{"instruction": "Wazuh detected event 'static route mismatch' on device EDGE-FW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.72.246.51", "event": "static route mismatch", "severity": "high"}, "requested_show": ["show ip route static", "show running-config | include ip route"]}
{"instruction": "Wazuh detected event 'lldp neighbor mismatch' on device BRANCH-RTR1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.239.164.13", "event": "lldp neighbor mismatch", "severity": "high"}, "requested_show": ["show lldp neighbors detail", "show lldp neighbors"]}
{"instruction": "Wazuh detected event 'link duplex mismatch' on device ACCESS-SW2 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.127.109.78", "event": "link duplex mismatch", "severity": "medium"}, "requested_show": ["show controllers", "show interfaces"]}
{"instruction": "Wazuh detected event 'interface flapping' on device ACCESS-SW2 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.172.212.221", "event": "interface flapping", "severity": "low"}, "requested_show": ["show interfaces", "show interfaces status", "show logging | include LINK"]}
{"instruction": "Wazuh detected event 'ip conflict detected' on device CORE-R1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.32.11.131", "event": "ip conflict detected", "severity": "low"}, "requested_show": ["show arp", "show ip interface", "show logging | include DUPLICATE"]}
{"instruction": "Wazuh detected event 'packet loss detected' on device CORE-R1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.98.7.119", "event": "packet loss detected", "severity": "high"}, "requested_show": ["show interfaces", "show interfaces counters errors"]}
{"instruction": "Wazuh detected event 'syslog flood detected' on device BRANCH-RTR1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.243.234.13", "event": "syslog flood detected", "severity": "critical"}, "requested_show": ["show logging", "show ip traffic", "show interfaces counters"]}
{"instruction": "Wazuh detected event 'nat translation failure' on device ACCESS-SW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.196.100.246", "event": "nat translation failure", "severity": "medium"}, "requested_show": ["show ip nat statistics", "show ip nat translations"]}
{"instruction": "Wazuh detected event 'bgp route leak suspected' on device CORE-R1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.233.108.167", "event": "bgp route leak suspected", "severity": "medium"}, "requested_show": ["show ip bgp", "show ip bgp neighbors", "show ip route"]}
{"instruction": "Wazuh detected event 'interface flapping' on device BRANCH-RTR1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.119.198.108", "event": "interface flapping", "severity": "medium"}, "requested_show": ["show logging | include LINK", "show interfaces status", "show interfaces"]}
{"instruction": "Wazuh detected event 'broadcast storm detected' on device CORE-R1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.254.60.90", "event": "broadcast storm detected", "severity": "medium"}, "requested_show": ["show ip traffic", "show mac address-table", "show interfaces counters"]}
{"instruction": "Wazuh detected event 'mac flapping detected' on device CORE-R1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.2.91.20", "event": "mac flapping detected", "severity": "high"}, "requested_show": ["show spanning-tree", "show mac address-table move", "show mac address-table"]}
{"instruction": "Wazuh detected event 'snmp brute-force' on device BRANCH-RTR1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.207.92.146", "event": "snmp brute-force", "severity": "medium"}, "requested_show": ["show logging | include SNMP", "show snmp user", "show snmp group"]}
{"instruction": "Wazuh detected event 'vpn tunnel down' on device ACCESS-SW2 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.134.239.254", "event": "vpn tunnel down", "severity": "high"}, "requested_show": ["show crypto ikev2 sa", "show interfaces", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected event 'firewall deny excessive' on device ACCESS-SW2 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.64.178.35", "event": "firewall deny excessive", "severity": "high"}, "requested_show": ["show conn", "show access-lists", "show firewall"]}
{"instruction": "Wazuh detected event 'mac flapping detected' on device ACCESS-SW2 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.132.219.74", "event": "mac flapping detected", "severity": "medium"}, "requested_show": ["show mac address-table", "show spanning-tree", "show mac address-table move"]}
{"instruction": "Wazuh detected event 'firewall deny excessive' on device ACCESS-SW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.29.215.143", "event": "firewall deny excessive", "severity": "critical"}, "requested_show": ["show conn", "show firewall", "show access-lists"]}
{"instruction": "Wazuh detected event 'syslog flood detected' on device ACCESS-SW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.164.159.163", "event": "syslog flood detected", "severity": "medium"}, "requested_show": ["show interfaces counters", "show ip traffic", "show logging"]}
{"instruction": "Wazuh detected event 'subnet overlap detected' on device ACCESS-SW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.208.209.44", "event": "subnet overlap detected", "severity": "medium"}, "requested_show": ["show running-config | include ip address", "show ip route"]}
{"instruction": "Wazuh detected event 'lldp neighbor mismatch' on device ACCESS-SW2 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.229.121.227", "event": "lldp neighbor mismatch", "severity": "high"}, "requested_show": ["show lldp neighbors detail", "show lldp neighbors"]}
{"instruction": "Wazuh detected event 'static route mismatch' on device CORE-R1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.140.76.173", "event": "static route mismatch", "severity": "critical"}, "requested_show": ["show running-config | include ip route", "show ip route static"]}
{"instruction": "Wazuh detected event 'bgp route leak suspected' on device ACCESS-SW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.88.21.177", "event": "bgp route leak suspected", "severity": "medium"}, "requested_show": ["show ip bgp", "show ip bgp neighbors", "show ip route"]}
{"instruction": "Wazuh detected event 'ipsec rekey storm' on device EDGE-FW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.234.56.68", "event": "ipsec rekey storm", "severity": "critical"}, "requested_show": ["show crypto ipsec sa", "show crypto ikev2 sa"]}
{"instruction": "Wazuh detected event 'ipsec rekey storm' on device ACCESS-SW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.50.83.198", "event": "ipsec rekey storm", "severity": "medium"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected event 'ddos high connection rate' on device CORE-R1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.244.13.104", "event": "ddos high connection rate", "severity": "low"}, "requested_show": ["show interfaces counters", "show conn", "show ip traffic"]}
{"instruction": "Wazuh detected event 'mtu mismatch' on device ACCESS-SW2 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.127.233.218", "event": "mtu mismatch", "severity": "medium"}, "requested_show": ["show ip ospf interface", "show interfaces"]}
{"instruction": "Wazuh detected event 'packet loss detected' on device CORE-R1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.19.95.123", "event": "packet loss detected", "severity": "high"}, "requested_show": ["show interfaces counters errors", "show interfaces"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device EDGE-FW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.99.227.222", "event": "dns exfiltration suspected", "severity": "high"}, "requested_show": ["show logging | include DNS", "show ip traffic", "show ip dns view"]}
{"instruction": "Wazuh detected event 'syslog flood detected' on device BRANCH-RTR1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.10.59.44", "event": "syslog flood detected", "severity": "low"}, "requested_show": ["show interfaces counters", "show ip traffic", "show logging"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device EDGE-FW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.194.109.29", "event": "failed login attempts", "severity": "high"}, "requested_show": ["show users", "show ip ssh", "show logging | include LOGIN"]}
{"instruction": "Wazuh detected event 'mtu mismatch' on device CORE-R1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.247.64.214", "event": "mtu mismatch", "severity": "medium"}, "requested_show": ["show interfaces", "show ip ospf interface"]}
{"instruction": "Wazuh detected event 'high cpu usage' on device CORE-R1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.36.85.147", "event": "high cpu usage", "severity": "high"}, "requested_show": ["show processes cpu sorted", "show platform resources", "show memory statistics"]}
{"instruction": "Wazuh detected event 'subnet overlap detected' on device EDGE-FW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.74.55.17", "event": "subnet overlap detected", "severity": "critical"}, "requested_show": ["show ip route", "show running-config | include ip address"]}
{"instruction": "Wazuh detected event 'bgp session flap' on device CORE-R1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.84.194.1", "event": "bgp session flap", "severity": "high"}, "requested_show": ["show ip route", "show ip bgp neighbors", "show logging | include BGP", "show ip bgp summary"]}
{"instruction": "Wazuh detected event 'port scan detected' on device EDGE-FW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.47.53.136", "event": "port scan detected", "severity": "medium"}, "requested_show": ["show ip traffic", "show conn", "show firewall", "show logging | include DENY"]}
{"instruction": "Wazuh detected event 'acl blocking legitimate traffic' on device ACCESS-SW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.89.23.81", "event": "acl blocking legitimate traffic", "severity": "high"}, "requested_show": ["show logging | include DENY", "show ip interface", "show ip route", "show access-lists"]}
{"instruction": "Wazuh detected event 'blacklisted ip communication' on device BRANCH-RTR1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.56.145.34", "event": "blacklisted ip communication", "severity": "critical"}, "requested_show": ["show access-lists", "show logging | include DENY", "show conn address", "show ip route"]}
{"instruction": "Wazuh detected event 'acl hitcount anomaly' on device EDGE-FW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.5.7.100", "event": "acl hitcount anomaly", "severity": "medium"}, "requested_show": ["show access-lists", "show access-lists | include hitcnt"]}
{"instruction": "Wazuh detected event 'nat translation failure' on device CORE-R1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.31.151.71", "event": "nat translation failure", "severity": "high"}, "requested_show": ["show ip nat translations", "show ip nat statistics"]}
{"instruction": "Wazuh detected event 'subnet overlap detected' on device ACCESS-SW2 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.237.32.156", "event": "subnet overlap detected", "severity": "medium"}, "requested_show": ["show running-config | include ip address", "show ip route"]}
{"instruction": "Wazuh detected event 'dns exfiltration suspected' on device CORE-R1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.130.151.86", "event": "dns exfiltration suspected", "severity": "critical"}, "requested_show": ["show logging | include DNS", "show ip dns view", "show ip traffic"]}
{"instruction": "Wazuh detected event 'ipsec rekey storm' on device ACCESS-SW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.96.233.41", "event": "ipsec rekey storm", "severity": "medium"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected event 'vlan mismatch detected' on device BRANCH-RTR1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.38.96.6", "event": "vlan mismatch detected", "severity": "high"}, "requested_show": ["show interfaces trunk", "show vlan brief"]}
{"instruction": "Wazuh detected event 'syslog flood detected' on device CORE-R1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.51.32.176", "event": "syslog flood detected", "severity": "medium"}, "requested_show": ["show interfaces counters", "show ip traffic", "show logging"]}
{"instruction": "Wazuh detected event 'syslog flood detected' on device EDGE-FW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.210.86.125", "event": "syslog flood detected", "severity": "medium"}, "requested_show": ["show ip traffic", "show interfaces counters", "show logging"]}
{"instruction": "Wazuh detected event 'bgp session flap' on device EDGE-FW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.142.44.38", "event": "bgp session flap", "severity": "low"}, "requested_show": ["show ip route", "show ip bgp neighbors", "show logging | include BGP", "show ip bgp summary"]}
{"instruction": "Wazuh detected event 'broadcast storm detected' on device BRANCH-RTR1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.126.113.53", "event": "broadcast storm detected", "severity": "critical"}, "requested_show": ["show ip traffic", "show interfaces counters", "show mac address-table"]}
{"instruction": "Wazuh detected event 'acl blocking legitimate traffic' on device EDGE-FW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.163.214.25", "event": "acl blocking legitimate traffic", "severity": "low"}, "requested_show": ["show ip route", "show logging | include DENY", "show access-lists", "show ip interface"]}
{"instruction": "Wazuh detected event 'tcp retransmissions high' on device ACCESS-SW2 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.237.111.31", "event": "tcp retransmissions high", "severity": "high"}, "requested_show": ["show ip traffic", "show interfaces", "show ip tcp statistics"]}
{"instruction": "Wazuh detected event 'tcp retransmissions high' on device EDGE-FW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.188.126.116", "event": "tcp retransmissions high", "severity": "low"}, "requested_show": ["show ip tcp statistics", "show interfaces", "show ip traffic"]}
{"instruction": "Wazuh detected event 'acl hitcount anomaly' on device BRANCH-RTR1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.61.14.141", "event": "acl hitcount anomaly", "severity": "medium"}, "requested_show": ["show access-lists | include hitcnt", "show access-lists"]}
{"instruction": "Wazuh detected event 'ipsec rekey storm' on device ACCESS-SW2 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.214.111.121", "event": "ipsec rekey storm", "severity": "high"}, "requested_show": ["show crypto ikev2 sa", "show crypto ipsec sa"]}
{"instruction": "Wazuh detected event 'broadcast storm detected' on device EDGE-FW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.103.254.170", "event": "broadcast storm detected", "severity": "critical"}, "requested_show": ["show mac address-table", "show interfaces counters", "show ip traffic"]}
{"instruction": "Wazuh detected event 'ospf lsa flood' on device ACCESS-SW2 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.69.107.115", "event": "ospf lsa flood", "severity": "low"}, "requested_show": ["show ip ospf", "show ip ospf database"]}
{"instruction": "Wazuh detected event 'ntp sync lost' on device BRANCH-RTR1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.140.212.169", "event": "ntp sync lost", "severity": "medium"}, "requested_show": ["show ntp status", "show clock", "show ntp associations"]}
{"instruction": "Wazuh detected event 'failed login attempts' on device BRANCH-RTR1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.89.194.72", "event": "failed login attempts", "severity": "high"}, "requested_show": ["show users", "show ip ssh", "show logging | include LOGIN"]}
{"instruction": "Wazuh detected event 'subnet overlap detected' on device ACCESS-SW2 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.172.82.193", "event": "subnet overlap detected", "severity": "critical"}, "requested_show": ["show running-config | include ip address", "show ip route"]}
{"instruction": "Wazuh detected event 'blacklisted ip communication' on device BRANCH-RTR1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.1.0.208", "event": "blacklisted ip communication", "severity": "medium"}, "requested_show": ["show access-lists", "show ip route", "show conn address", "show logging | include DENY"]}
{"instruction": "Wazuh detected event 'memory leak suspected' on device ACCESS-SW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.24.206.79", "event": "memory leak suspected", "severity": "high"}, "requested_show": ["show processes memory sorted", "show memory statistics"]}
{"instruction": "Wazuh detected event 'port scan detected' on device ACCESS-SW2 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.14.37.35", "event": "port scan detected", "severity": "low"}, "requested_show": ["show conn", "show logging | include DENY", "show access-lists", "show firewall", "show ip traffic"]}
{"instruction": "Wazuh detected event 'acl blocking legitimate traffic' on device BRANCH-RTR1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.119.75.129", "event": "acl blocking legitimate traffic", "severity": "high"}, "requested_show": ["show ip route", "show logging | include DENY", "show ip interface", "show access-lists"]}
{"instruction": "Wazuh detected event 'mac flapping detected' on device EDGE-FW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.231.57.57", "event": "mac flapping detected", "severity": "medium"}, "requested_show": ["show spanning-tree", "show mac address-table", "show mac address-table move"]}
{"instruction": "Wazuh detected event 'bgp session flap' on device EDGE-FW1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.159.111.93", "event": "bgp session flap", "severity": "low"}, "requested_show": ["show ip route", "show ip bgp neighbors", "show ip bgp summary", "show logging | include BGP"]}
{"instruction": "Wazuh detected event 'mac flapping detected' on device ACCESS-SW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.89.17.247", "event": "mac flapping detected", "severity": "high"}, "requested_show": ["show mac address-table move", "show mac address-table", "show spanning-tree"]}
{"instruction": "Wazuh detected event 'mac flapping detected' on device ACCESS-SW1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.48.192.245", "event": "mac flapping detected", "severity": "medium"}, "requested_show": ["show mac address-table", "show spanning-tree", "show mac address-table move"]}
{"instruction": "Wazuh detected event 'acl hitcount anomaly' on device CORE-R1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.216.45.22", "event": "acl hitcount anomaly", "severity": "critical"}, "requested_show": ["show access-lists | include hitcnt", "show access-lists"]}
{"instruction": "Wazuh detected event 'blacklisted ip communication' on device CORE-R1 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.78.164.76", "event": "blacklisted ip communication", "severity": "low"}, "requested_show": ["show access-lists", "show conn address", "show ip route", "show logging | include DENY"]}
{"instruction": "Wazuh detected event 'mac flapping detected' on device EDGE-FW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.195.33.238", "event": "mac flapping detected", "severity": "high"}, "requested_show": ["show spanning-tree", "show mac address-table", "show mac address-table move"]}
{"instruction": "Wazuh detected event 'stp loop detected' on device CORE-R1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "CORE-R1", "src_ip": "10.85.75.54", "event": "stp loop detected", "severity": "high"}, "requested_show": ["show mac address-table move", "show spanning-tree detail", "show spanning-tree"]}
{"instruction": "Wazuh detected event 'ntp sync lost' on device ACCESS-SW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW1", "src_ip": "10.34.121.45", "event": "ntp sync lost", "severity": "critical"}, "requested_show": ["show ntp status", "show clock", "show ntp associations"]}
{"instruction": "Wazuh detected event 'stp loop detected' on device BRANCH-RTR1 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.140.98.248", "event": "stp loop detected", "severity": "medium"}, "requested_show": ["show mac address-table move", "show spanning-tree detail", "show spanning-tree"]}
{"instruction": "Wazuh detected event 'cdp rogue device' on device BRANCH-RTR1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.189.4.90", "event": "cdp rogue device", "severity": "high"}, "requested_show": ["show cdp neighbors", "show cdp neighbors detail"]}
{"instruction": "Wazuh detected event 'mac flapping detected' on device BRANCH-RTR1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "BRANCH-RTR1", "src_ip": "10.216.164.74", "event": "mac flapping detected", "severity": "high"}, "requested_show": ["show spanning-tree", "show mac address-table", "show mac address-table move"]}
{"instruction": "Wazuh detected event 'mtu mismatch' on device EDGE-FW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.83.40.107", "event": "mtu mismatch", "severity": "high"}, "requested_show": ["show interfaces", "show ip ospf interface"]}
{"instruction": "Wazuh detected event 'nat translation failure' on device EDGE-FW1 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.20.221.41", "event": "nat translation failure", "severity": "critical"}, "requested_show": ["show ip nat statistics", "show ip nat translations"]}
{"instruction": "Wazuh detected event 'stp loop detected' on device ACCESS-SW2 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.20.67.46", "event": "stp loop detected", "severity": "low"}, "requested_show": ["show mac address-table move", "show spanning-tree", "show spanning-tree detail"]}
{"instruction": "Wazuh detected event 'ospf lsa flood' on device ACCESS-SW2 with severity 'low'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.211.6.75", "event": "ospf lsa flood", "severity": "low"}, "requested_show": ["show ip ospf", "show ip ospf database"]}
{"instruction": "Wazuh detected event 'ssh brute-force' on device ACCESS-SW2 with severity 'critical'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.190.54.52", "event": "ssh brute-force", "severity": "critical"}, "requested_show": ["show users", "show ip ssh", "show ip interface brief", "show access-lists"]}
{"instruction": "Wazuh detected event 'tcp retransmissions high' on device ACCESS-SW2 with severity 'medium'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "ACCESS-SW2", "src_ip": "10.244.107.245", "event": "tcp retransmissions high", "severity": "medium"}, "requested_show": ["show ip traffic", "show interfaces", "show ip tcp statistics"]}
{"instruction": "Wazuh detected event 'arp spoofing suspected' on device EDGE-FW1 with severity 'high'. List ALL Cisco show commands required to diagnose the issue, focusing on routing, interfaces, logs, errors, neighbors, sessions, and traffic.", "wazuh_alert": {"device": "EDGE-FW1", "src_ip": "10.41.153.136", "event": "arp spoofing suspected", "severity": "high"}, "requested_show": ["show ip traffic", "show mac address-table", "show arp", "show ip verify source"]}